This is a HTTP/HTTPS request from GW so indeed as Andy mentioned Filr or Vibe but also the less used panel folder with an URL/website. If you want to see how/what it tries to do a wireshark LAN trace on the workstation will probably show the request causing this

Ok, Filr is integrated, but it was in last version of our GW too.

Filr asked once for authentification using a similar dialog box, but after doing this it never appeared again.

The internet proxy didn't change and needs no authentification. The dialog box on every gw client start makes no sense.

as i mentioned seeing what it is trying to access in a wireshark LAN trace might explain

as i mentioned seeing what it is trying to access in a wireshark LAN trace might explain

Wireshark, one of the swiss army knives in IT. In system environments that I am allowed to support, a split DNS is generally used and care is taken to ensure that the same suffix is used internally as it is externally. At this point, please no for or against. In IT today, we find ourselves in a situation that is best described by the term fog computing (CISCO term). It is something fundamental that the name service is structured in the same way internally and externally and that the corresponding service is presented to the client with the IP / DNS that corresponds to the location of the client via suitable procedures (DDI). If the client is inside the perimeter network, automatic proxy rules must be set accordingly. A DDI can also solve this problem. With DNSSEC and Pihole, DDI can offer a very good approach for DNS / DHCP IP security.

In this case, the solution is to get the WinProxy to provide appropriate exceptions for Filr, Vibe or whatever via policies. Thank you for bringing a Swiss army knife of IT back to mind

George