I am on the BetaTest for Little Snitch Mini, and while the App is now collecting data for a week or so, I figured out, that Ulysses seems to have a part “stats.ulysses.app” that is sending data towards Moscow.
Has anyone here observed something similar, or has an “good” explanation for that?
My subscription has expired, but didn’t see any activity to Russia when I ran it and fooled around a bit.
I used SpyBuster, by one of the MacPaw developers.
Here’s the SpyBuster output:
Could it be some CDN or a geolocation service having outdated IP blocks, but for me stats.ulysess.app is resolving to 195.201.141.230, which is mapping to a German location hosted by Hetzner.
From the US, that domain gives me Hetzner as well. Odd.
Yes, stats.ulysses.app leads to Hetzner - not in Moscow, but in Gunzenhausen (which is a funny name for a city not only for non-native German speakers). 
It looks like a Little Snitch Mini bug - or at least an issue with their data source. If it is a beta, it might be an idea to contact the developer in order to look into how they resolve stats.ulysses.app, I guess.
Then again, it could be some other malware that is doing it.
I would run SpyBuster, then MalwareBytes just to be sure.
