I downloaded an Gnome flavored PureOS 9.0 ISO from the official Purism site, sha256sum was good.
Full install in a KVM
Full update & upgrade
Only Install Safing Portmaster (I really recommend the app)
The Portmaster detected rogue DNS requests to the European Central Bank and International Monetary Foundation
I repeated all again with a completely new ISO in virtual machiner and did it with USB boot as well
Portmaster can block thies but please help with how we can stop this fully
strings /usr/bin/gcalccmd |grep imf
it’s gnome calc currency converter
it’s part of financial mode of gnome-calculator to fetch currencies.
"When you are paranoid you have to learn programing, debugging and investigating things. "
Hello & thank you to all pureos developmenters for making pureos & yourself for this solving of problem.