Okay, so I found the culprit. This is in-fact a false positive related to two abuse.ch domains that are resolving to a CDN that has been used to host malware in the past. (or maybe a spammer falsely reported them as such!)
/var/lib/docker/containers/6601194c55ade3b5a08d6a1cda77b3ebfc9e8d882212c450c7a712ef0d54b86e/6601194c55ade3b5a08d6a1cda77b3ebfc9e8d882212c450c7a712ef0d54b86e-json.log:21964:{"log":"2025-03-12 19:25:51 #38(controller) \u003cc6onet\u003e; map; http_map_error: error reading https://**bazaar.abuse.ch**/export/txt/md5/recent/(151.101.2.49:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out\n","stream":"stderr","time":"2025-03-12T19:25:51.170320692Z"}
/var/lib/docker/containers/6601194c55ade3b5a08d6a1cda77b3ebfc9e8d882212c450c7a712ef0d54b86e/6601194c55ade3b5a08d6a1cda77b3ebfc9e8d882212c450c7a712ef0d54b86e-json.log:21979:{"log":"2025-03-12 19:36:26 #38(controller) \u003c7m3drg\u003e; map; http_map_error: error reading https://**urlhaus.abuse.ch**/downloads/text_online/(151.101.2.49:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out\n","stream":"stderr","time":"2025-03-12T19:36:26.050488101Z"}
`; <<>> DiG 9.18.30-0ubuntu0.24.04.2-Ubuntu <<>> urlhaus.abuse.ch
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38090
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;urlhaus.abuse.ch. IN A
;; ANSWER SECTION:
urlhaus.abuse.ch. 17 IN CNAME p2.shared.global.fastly.net.
p2.shared.global.fastly.net. 60 IN A 151.101.2.49
p2.shared.global.fastly.net. 60 IN A 151.101.130.49
p2.shared.global.fastly.net. 60 IN A 151.101.66.49
p2.shared.global.fastly.net. 60 IN A 151.101.194.49
`
