Little Snitch just caught automountd trying to connect to two spammy sites. From research, I found out automountd is "a system service which mounts and unmounts network file systems" but I wasn't manually opening any files / mounting any filesystems at the time. Here are screenshots of the Little Snitch warnings: This is not Time Machine trying to connect to Backups.backupdb through automountd problem that comes up in google searches. I had Google Chrome open and I was trying a trial out of Virusbarrier V6. Perhaps Virusbarrier was scanning files on my drive, called automountd to open a file of some sort, which tried to connect to spam sites? That's the only thing I can think of. How to do find out why this happened?