blah blah /nxt
then the blockchain loads a little more and avast says the same thing but a slightly different url each time?
also why does it say close nxt because system running out of memory with 16gb ram? even after a restart?
This is probably nothing. Antivirus software have outdated databases of blacklisted IP addresses, known to have launched attacks in the past. One example is a vpn service that has many customers, all reaching internet through the same IP address. Normally it is safe to add a rule to the antivirus software to allow connections of the NXT client to these IPs. Be sure to always download your NXT client and any cryptocurrency client from legit official repositories.
With regards to memory, you can try to add a -Xmx1024M setting to run.bat file to limit memory consumption of your node. Open run.bat in Notepad and change the line that launches NXT to begin like this:
${JAVA} -Xmx1024M