Random connections to Mail.ru

[sevendogsbsd]

Have had my Note 8 for a few months and not had any issues. Recently noticed while at home, my firewall logs are showing my Note 8 attempting outbound connections to "mail.ru". I realize that in and of itself is not malicious but because since I reside in the US, it is not something I want or need. I have done a factory wipe and set up but the behavior continues intermittently. I have Netstat Plus on my phone so will need to periodically check it for connections but since it doesn't retain a log and is in real time, my firewall logs are the only persistent record of this connection attempt.

Unfortunately, when on cell data, the connections will not be blocked. Any idea what app (besides mail.ru) or apps routinely make connections to this domain?

Thanks in advance.

 

[mikedt]

Suggest you check through the apps and games you've installed and see if there's any from possibly Russian developers, e.g. ICQ which is mail.ru. Developer contact details(and sometimes addresses) are usually found in the Play Store for the apps that are on there.

 

[sevendogsbsd]

Thank you for your reply - I do not have any games installed and normally check apps for the developer location but I'll run back through what is installed and double check. Thanks for the tip.

I think I may have found the issue but will watch the traffic over the next few days to be sure. I use Telegram to communicate with family and learned the devs for this are originally from St. Petersburg. No other app on my phone has any ties to Russia except that one. Only thing I can think of so going to watch the logs and see what happens.

 

[mikedt]

I think I may have found the issue but will watch the traffic over the next few days to be sure. I use Telegram to communicate with family and learned the devs for this are originally from St. Petersburg. No other app on my phone has any ties to Russia except that one. Only thing I can think of so going to watch the logs and see what happens.

The Telegram devs also started VK(a sort of Russian Facebook) and that's owned by mail.ru.
mail.ru also provides cloud data services, and possibly Telegram is pinging and using that.

 

[sevendogsbsd]

Ah OK, well that makes me lean even more towards Telegram being the culprit. Thanks again!