it checks for plugin blocklist (as mentioned in the article)

it probably also downloads a list of malware websites (called "reported attack site" and "reported webforgeries"in firefox)