So I came searching because my company's intranet site is behaving the same way. The thing is, OneSignal is a push notification API I have subscribed to to allow my website to send notifications to desktop and mobile users. It is not malicious, and shouldn't be blocked (in my opinion). This behavior just started today but I've been using OneSignal for on this site for over a year.
My guess is many websites use OneSignal for notifications on their website, and if you've allowed them in your browser then the connection to this site is attempted. For some reason, MalwareBytes has decided to block them.
