After Zoom install: macOS forwards various requests to localhost
Unbelievable, after months of digging around cluelessly, I seem to have found it out. Apparently, the IPs
103.86.99.99
103.86.96.96

are part of some malicious part, they appear here:
$ scutil --dns
resolver #1
  search domain[0] : 
  nameserver[0] : 192.168.178.1
  nameserver[1] : fd00::7eff:4dff:fe7e:56fa
  if_index : 5 (en0)
  flags    : Scoped, Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #2
  nameserver[0] : 103.86.99.99
  nameserver[1] : 103.86.96.96
  if_index : 14 (ipsec0)
  flags    : Scoped, Request A records
  reach    : 0x00000003 (Reachable,Transient Connection)

and this resolver #2 isn't shown in any DNS settings in the system config.
running $sudo scutil, I found these IPs in this entry:
&gt;get State:/Network/Service/39118383-7AC1-4270-AA42-7F97B4505F57/DNS

&gt;d.show


&lt;dictionary&gt; {

  ConfirmedServiceID : 39118383-7AC1-4270-AA42-7F97B4505F57

  ServerAddresses : &lt;array&gt; {
    0 : 103.86.99.99
    1 : 103.86.96.96
  }


The top answer here showed me how to replace this entry with a proper one. After that, I ran:
sudo rm /etc/resolv.conf

sudo ln -s /var/run/resolv.conf /etc/resolv.conf

What kind of crap could that have been ?