[roscas]

I use Chromium or LibreWolf and use Perplexity site. It cannot install anything I guess as I only use it from the webpage. OS is ArchLinux with Chromium, but I did not use tcpdump yet. I will try it. I notice the connections with OpenSnitch that pop's up every call made that is not authorized. And I can see it was UDP.

[Bender]

I think perplexity has an app that installs via snapd and may have systemd timers but if you did not install anything then only the browser should be making calls and only when you opened it so I guess just poke around in /etc/systemd, /usr/lib/systemd and /etc/cron* to see if anything was recently added without your knowledge. Also check your browser addons.

Good luck!

[roscas]

The only extension I have is uBlock Origin. Arch does not have snaps. SystemD dirs look normal and no cronjobs running.

Mistery... but thanks for the tips.