[ChrisSD]

You're right. My Android One Nokia 7.1 comes with at least 64 evenwell/HMDGlobal apps, albeit behind the scenes. There's no docs on any of them as far as I can tell so you can only guess from the name what they do.

https://pastebin.com/LehzyCMU

That said I've not noticed anything obviously suspicious when I use a firewall to monitor it. I only did it as a test so I might have missed something. Also I'm in the UK, if that makes a difference.

[shrikant]

I've got a Nokia 8 (also bought in the UK) with the Evenwell system apps as well, and I haven't noticed any unusual domains in my Pi-hole logs at home.

I wonder if it's only specific country builds that display this behaviour?

[bestham]

These apps can freely choose to only use the cellular modem for communication and thus communication may not show up in your firewall / proxy. In addition to this, your carrier can't distinguish legitimate traffic generated by you from malicious traffic generated by these applications.