[acqq]

Not "DOM" but a hashes of the URL or a part of it, to check if the domain or URL is "safe." Also downloads are checked. And AFAIK it's more nuanced, there's also a database that can be checked and allow "offline" checks. But it would still be interesting to find one independent serious analysis of the behavior.

[themihai]

Actually it sends the DOM model too. It's named client side detection. https://news.ycombinator.com/item?id=5971403