Java applets are compiled code. The URL of the button is probably dynamically created -- I presume that's why it was made as an applet in the first place -- so the straightforward solution is to disassemble/decompile the applet and see what it's doing.

An alternative is to find a tool that clicks the button (maybe by sending keystrokes to the applet) and check which site gets loaded.

If site is loaded within the applet (as oppose to being loaded by the browser at the request of the applet), you could write your own security manager. I think all it takes is to write a subclass of java.lang.SecurityManager which overrides checkPermission with a method that looks for permissions of type java.net.SocketPermission. You could even throw a security exception if you don't want the site to actually be loaded.