nslookup-ed about half of the displayed IPs - and all belong to avast! updating servers.
So I guess it's simply the checks for virus database or program updates (trying a random server from the list each time)...
On the other hand, the IS ad is an interesting idea as well... no idea how often it's refreshed, might be possible.
