[General Questions and Answers] TheSleepyDroid:
I got a Moto G phone running Oreo. I have a firewall installed, and its logs show an app with the name "System" trying to connect to various AWS hosted addresses. The phone is not rooted. I am trying to find out which process this System actually is, and what is its purpose. I am trying to somehow capture some traffic and find something.

If anyone knows what exactly this is and whether I should be worried or not, please let me know.

Here are some of them:

server-52-222-149-174.fra53.r.cloudfront.net:443

server-52-222-149-128.fra53.r.cloudfront.net:443

server-52-222-149-139.fra53.r.cloudfront.net:443

server-52-222-149-89.fra53.r.cloudfront.net:443

server-52-222-149-54u.fra53.r.cloudfront.net:443

server-52-222-149-143.fra53.r.cloudfront.net:443

server-52-222-149-206.fra53.r.cloudfront.net:443

server-52-222-149-99.fra53.r.cloudfront.net:443

server-54-230-93-53.fra2.r.cloudfront.net:443

server-54-230-93-231.fra2.r.cloudfront.net:443

server-54-230-93-238.fra2.r.cloudfront.net:443

server-54-230-93-128.fra2.r.cloudfront.net:443

server-54-230-93-148.fra2.r.cloudfront.net:443

server-54-230-93-236.fra2.r.cloudfront.net:443

server-54-230-93-37.fra2.r.cloudfront.net:443

server-54-230-93-198.fra2.r.cloudfront.net:443

server-54-230-93-211.fra2.r.cloudfront.net:443

server-54-230-93-54.fra2.r.cloudfront.net:443

server-54-230-93-207.fra2.r.cloudfront.net:443

server-54-230-8-80.lhr3.r.cloudfront.net:443

server-54-230-8-118.lhr3.r.cloudfront.net:443

server-54-230-8-51.lhr3.r.cloudfront.net:443

server-54-230-8-31.lhr3.r.cloudfront.net:443

server-54-230-8-199.lhr3.r.cloudfront.net:443

server-54-230-8-29.lhr3.r.cloudfront.net:443

server-54-230-8-87.lhr3.r.cloudfront.net:443

server-54-230-8-156.lhr3.r.cloudfront.net:443

server-54-230-8-122.lhr3.r.cloudfront.net:443

server-54-230-8-12.lhr3.r.cloudfront.net:443

server-54-230-8-6.lhr3.r.cloudfront.net:443

server-54-230-8-98.lhr3.r.cloudfront.net:443

server-54-230-8-53.lhr3.r.cloudfront.net:443

server-13-32-158-252.fra56.r.cloudfront.net:443

server-13-32-158-222.fra56.r.cloudfront.net:443

server-13-32-158-26.fra56.r.cloudfront.net:443

server-13-32-158-38.fra56.r.cloudfront.net:443

server-13-32-158-107.fra56.r.cloudfront.net:443

server-13-32-158-254.fra56.r.cloudfront.net:443

server-13-32-123-5.lhr4.r.cloudfront.net

server-13-32-123-73.lhr4.r.cloudfront.net

server-13-32-123-75.lhr4.r.cloudfront.net

server-143-204-181-81.lhr50.r.cloudfront.net:443

server-143-204-181-49.lhr50.r.cloudfront.net:443

server-143-204-181-63.lhr50.r.cloudfront.net:443

server-143-204-229-32.cdg3.r.cloudfront.net

server-143-204-229-114.cdg3.r.cloudfront.net

server-143-204-229-17.cdg3.r.cloudfront.net

server-143-204-229-102.cdg3.r.cloudfront.net

server-143-204-229-85.cdg3.r.cloudfront.net

server-143-204-229-71.cdg3.r.cloudfront.net

server-143-204-229-20.cdg3.r.cloudfront.net

server-143-204-15-118.mxp64.r.cloudfront.net

server-143-204-15-20.mxp64.r.cloudfront.net

server-143-204-15-40.mxp64.r.cloudfront.net

server-143-204-15-4.mxp64.r.cloudfront.net

server-143-204-15-18.mxp64.r.cloudfront.net

server-143-204-15-72.mxp64.r.cloudfront.net

server-143-204-15-68.mxp64.r.cloudfront.net

server-143-204-15-112.mxp64.r.cloudfront.net

[IMG="Screenshot of blocked connections"]https://i.postimg.cc/Hn7gw9gF/Screenshot-20181019-144026-1.png[/IMG]

-----------------------------------------------------------

I found some more information using logcat:

[ 10-19 17:12:33.467 1229: 1309 E/LocSvc_xtra2 ]

connect:204] connect to 54.230.93.211 failed

This is one of the IPs that System process is trying to connect. Some googling tells that this is Location Service being used probably. I have GPS turned off completely when I don't need it. I have also given access to GPS only to OpenMaps application which isn't running at the moment. All google apps are in disabled state.

I also noticed that these connection attempts happen every 5-6 minutes.

I cannot use strace as don't have root. I am trying to route the traffic from the phone through my PC to be able to capture network traffic.