Inbound requests after opening Electrum A few days ago, I was exploring Electrum (Android) out of curiosity. A few moments later, I get notified by our firewall that it flagged several suspicious inbound requests. The source IPs came from various countries, all of which use port 50002. The destination was my phone, at seemingly random ports. I disconnected my phone from the internet, and the requests would stop. They'd start again if I connected and used Electrum.

Initially, I thought Electrum was P2P and was doing peer discovery, which would conveniently explain why a machine over the internet would attempt to talk to my machine. But reading ElectrumX's docs and several other online resources, Electrum is a client-server setup - wallets talk to servers. The only P2P component I see is when servers talk to other servers to find other servers or advertise their presence to other servers. But this would not explain the inbound connection to my machine.

So what's going on? Is this normal behavior? Is the wallet also a "peer"? Or is this some malicious attempt to break in? Everyone coming from port 50002 and Electrum servers using port 50002 is probably not coincidence though. Thoughts? Did I miss some detail in the docs?
As @Anonymous said Electrum servers listen on port 50002 so that's what you are seeing here. Your phone is connecting from a random local port to remote 50002 on the servers. 

Electrum gets blockchain data from electrum servers run by volunteers. These servers see your addresses + transactions but they don't see your private keys or seed. So you lose privacy compared to using a full node like bitcoin core but you still have exclusive control of the secrets that let you spend your bitcoins. The upside of using electrum over a full node is that you don't have to download the 200GB blockchain. You can get up and running straight away.