I enabled traffic logging in the firewall After stopping all Internet applications, only Google framework services exchange traffic. This is probably the activity of system applications.
As for browser traffic, I don’t know which IPs may belong to advertising services.
I found some mention in the search engine:
“AppTornado with its product AppBrain provides an Android apps discovery, promotion and monetization platform to developers and users. It provides play store analytics in the means of rankings and statistics to developers and an optimization platform based on cost per install for their Android apps. It enables users to discover apps using the platform by providing personalized and daily app recommendations.”