What are some URLs that were detected by the firewall?

[personalizedrefriger]

These look like the domains Joplin uses to fetch plugin updates and the list of plugins.

Internally, Joplin maintains a list of GitHub mirrors that are used if Joplin is unable to fetch plugin data with raw.githubusercontent.com. Plugins are stored in the joplin/plugins repository.

This is the relevant code:

laurent22/joplin/blob/2c0f8d5c6be150475a3534ba5c5df3413fec825e/packages/lib/services/plugins/RepositoryApi.ts#L19