GreatBlue

Could you post the output of ufw status verbose ?

I can see a bot doing it, behaving like the Piped-Bot with an explanation why it's important to remove the tracking.

You can 'future proof' your mail by using your own domain and use it with your proton account.
So if you want or need to change your mail provider or self host in the future, you just need to redirect your domain to your new provider.

It's a good bot ;-)

Nothing says "keeping all the malware out" more, than constantly having to remove malware ;-)
https://www.scmagazine.com/analysis/meta-uncovers-400-malicious-apps-on-android-and-ios-apps
https://cointelegraph.com/news/fake-trezor-crypto-app-removed
https://threatpost.com/click-fraud-malware-apple-app-store/149496/