The information is downloaded by default from a Google database once a day.
A file named urlclassifier.sqlite was used, but the format had to be changed because the file (obviously) contained references to phishing sites, which anti-virus software noticed and complained about.