I use NoRoot Firewall on my Android Phone, and I have to stop it at times because it breaks my applications. Because of this, I decided to do deeper dig into some of the system services, particularly Google Backup Transport, Google Play services, and Google Services Framework. These Google services made up for 30+ services requesting remote access (the IP addresses are listed below this post) These IP addresses connect to either port 443 or 5228. Port 443 is a well known port for secure tunneling, meaning its likely used to transmit encrypted data. Port 5228 is used by Android Market & some Chrome processes.
What is interesting is that NoRoot Firefall by default blocks outgoing connections, which is the same thing that got Disconnect.me banned from the Google Play Store in 2015:
Google removed Disconnect Mobile from the Google Play store for violating its policy against apps that interfere with other apps. To protect user privacy, Disconnect blocks “unsolicited network connections” between a mobile user’s app or browser and services involved in tracking or malvertising.
Perhaps Disconnect.me they should have listed as a firewall in Google Play instead of marking unsolicited network connections. From a practical point of view it would have kept them in the store, though I suspect they would have some disgust from such a decision. In either case, I am grateful for the privacy minded focus of both of these apps. Note that Disconnect.me is still not available in the Google App store, but is available on IOS.
Here is a list of 33 ip addresses connecting out shown as google services. Why are so many IP addresses going, and what do they all do?