One thing others haven't mentioned is DNS. If your phone is trying to lookup Windows Update it's a surefire way of knowing this didn't originate in the phone.