Update to - Destination to China post

Above is the Little Snitch Mini screen cap showing with TLD cn block turned off in NextDNS and block on in Little Snitch Mini

I set up a macOS test SSD without any non Apple software installed, except NextDNS. From there I populated the drive with a few app which might be the cause of this.

The culprit turned out to be Avast Antivirus - As soon as I Installed it, both the apple and icloud "com.cn" showed up, blocked by the NextDNS TLD block. Installed Little Snitch Mini and released the NextDNS block and caught them with Little Snitch Mini block - again identified as originating from the NextDNS app. Uninstalled Avast and they stopped.

Uninstalled Avast on the main drive and no sign of them in the NextDNS logs or the Little Snitch Mini block window.

Looks like Avast is playing the reverse Uno card on NextDNS.