App assignment error vs Android is like winblows

[working-name]

Hello there,

Seeing a lot of connections to the same host (i.e. firebaseinstallations.googleapis.com) from pretty much the most weird of apps possible. That hostname is very common, so I guess there could be a 0.001% chance that all of the apps need to contact it at the same time. But, there's lots of other hosts that I find in the connection log that have nothing to do with the app it's being listed under. Hence my question(s):

1. Is Android like windows where there's some dumb central process routing DNS requests like winblows does? (Safing.io had the biggest problem with misattribution due to how the windows network stack works)
2. Is android coded like malware, where it routes connections via other processes or impersonates other processes to bypass user blocks? I wouldn't put it past google, they did try to kill ublock origin after all...
3. Does ReThink have a bug in attributing connections to the right process?
4. Why are there 94 apps clumped under a single entry without control or log of individual services/apps/processes actually making the requests? (i.e. CcInfo + 93 other app(s))

[ignoramous]

Android like windows where there's some dumb central process routing DNS requests

Yes.

Until Android Q, the DNS requests are always attributed to the OS. After Q, AOSP leaves it upto the manufacturer/OEM to enable/disable this behaviour.

where it routes connections via other processes or impersonates other processes to bypass user blocks?

System and Vendor (OEM) apps do get special privileges, yes.

ReThink have a bug in attributing connections to the right process

Possible, but in v055o we've completely rewritten this bit, so a bug in the upcoming version (v055o) is unlikely.

are there 94 apps clumped under a single entry

Those apps are signed with the same "key" / owned by the same developer and thus assume the same "identity". Unfortunately, there's no obvious way to separate them as far accounting for their network use is concerned.

(moving this to discussions)

[onetimecontributor]

4. Why are there 94 apps clumped under a single entry without control or log of individual services/apps/processes actually making the requests? (i.e. CcInfo + 93 other app(s))

these huge sets are typically system/core apps like on Samsung (I isolate or block them typically), but some smaller pairs are also happening (like some Google pairs)