a.edenhauser/Shelly-Loqed-Touch
1
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity

doc0 - 1.6, 1.7/2.3

Browse Source
This commit is contained in:
a.edenhauser
2026-10-21 11:57:05 +02:00
parent 3b450d2a12
commit 70ab0354eb
6 changed files with 773 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Document0-Initial_Information_Gathering.md
+62 -7
View File
@@ -120,24 +120,79 @@ Here you can see:
## 1.6 Collect "Fresh" Firmware Dump
As the lock has been tampered with before, the FW dump is not entirely "fresh."
The device has been tampered with before, therefore there is no fresh dump available.
## 1.7 && 2.3 Initial setup
The initial setup is done using the Shelly App. The capture can be found [here](captures/init.pcapng).
Unsure which IP address is most relevant, here are all Shelly-like or LOQED-like addresses:
- `34.62.47.252`: changelog-backend.shelly.cloud0
- `34.95.90.149`: control.shelly.cloud
- `104.155.32.247`: shelly-120-eu.shelly.cloud
- `34.155.200.196`: integrations.loqed.com
- `35.205.173.252`: app-ratings.shelly.cloud, paypal.shelly.cloud, shelly-infra1-eu.shelly.cloud
- `34.79.5.199`: shelly-101-eu.shelly.cloud
- `35.241.201.25`: repo.shelly.cloud
For the PreTester analysis, I chose control.shelly.cloud, as I suspect the lock to communicate to a cloud via the bridge.
As the bridge has a built in ESP32 supporting WiFi, I suspect the communication looks as follows:
<img src="img/sequence_diagram.png" alt="PlantUML sequence diagram of suspected communication flow" width="400">
The [PreTester report](pretester_reports/init_report.md) didn't find anything unusual.
It reported no critical or high findings.
### Old Initial Setup Capture
You can also find an older initial setup capture made by Manu [here](captures/old_init.pcapng).
I tested this in the PreTester as well using integrations.loqed.com, as this seemed to be the most present IP in the capture.
The [report](pretester_reports/old_init_report.md) can be found here.
Once again, it reported no critical or high findings.
> The old init capture supposedly was the first real fresh setup. As mentioned, the lock has been tempered with before.
### URLs and Endpoints
I used the PreTester to probe all URLs and endpoints, here are some (interesting) findings:
|Endpoint|Ports|TLS|Cipher|
|:-|:-|:-|:-|
|app-ratings.shelly.cloud|22, 80, 443, 8000|v1.2|ECDHE-RSA-AES256-GCM-SHA384|
|changelog-backend.shelly.cloud|22, 80, 443|v1.2|ECDHE-ECDSA-AES256-GCM-SHA384|
|control.shelly.cloud|22, 80|v1.3|TLS_AES_256_GCM_SHA384|
|integrations.loqed.com|80, 443, 8080|v1.3|TLS_AES_128_GCM_SHA256|
|paypal.shelly.cloud|22, 80, 443, 8000|v1.3|ECDHE-RSA-AES256-GCM-SHA384|
|repo.shelly.cloud|22, 80, 443|v1.3|TLS_AES_256_GCM_SHA384|
|shelly-101-eu.shelly.cloud|22, 80, 443, **31234**|v1.3|TLS_AES_256_GCM_SHA384|
|shelly-120-eu.shelly.cloud|22, 80, 443, **6113**|v1.3|TLS_AES_256_GCM_SHA384|
|shelly-infra1-eu.shelly.cloud|22, 80, 443, 8000, **9443**|v1.2|ECDHE-RSA-AES256-GCM-SHA384|
|api.production.loqed.com|80, 443, 8080|v1.3|TLS_AES_128_GCM_SHA256|
|mqtt.production.loqed.com|80, 443, 8080, **8883**|v1.3|TLS_AES_128_GCM_SHA256|
> Includes the old init.
## 1.8 Collect Firmware Dump of Firmware after initial Setup
### Bridge
### Outer Module
## 1.7 && 2.3 Initial setup
## 1.8 Collect Firmware Dump of Firmware after initial Setup
## 1.9 && 2.4 Firmware Update
## 1.10 Collect Updated Firmware Dump
### Bridge
### Outer Module
## 1.11 Collect Firmware Dump after Factory Reset
### Bridge
### Outer Module
## 1.12 (Optional for now) Instantiate Device Model
## 1.13 Collect App APKs
captures/init.pcapng
BIN
View File
Binary file not shown.
captures/old_init.pcapng
BIN
View File
Binary file not shown.
img/sequence_diagram.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 8.9 KiB

pretester_reports/init_report.md
+305
View File
@@ -0,0 +1,305 @@
# IoT PreTester 4.6 — Network Capture Security Analysis
- **Capture:** `/app/files/uploads/init-925dbe660d8b.pcapng`
- **Packets:** 3326 · **Duration:** 104.486 s · **Findings:** 7
- **Device under test:** `34.95.90.149` (MAC 52:54:00:3a:bf:97) · device-related findings: 1, other hosts: 6
## Summary
| Severity | Count |
| ----------- | ------ |
| CRITICAL | 0 |
| HIGH | 0 |
| MEDIUM | 4 |
| LOW | 2 |
| INFO | 1 |
## Findings
### 1. Clear-text protocol: HTTP on 151.101.65.91:80
- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
- **📍 Sources:**
- Packet #716 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
- Packet #744 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
- Packet #759 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
- Packet #762 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
- **Risk:** HTTP content is unencrypted and can be read or modified on the path.
- **Affected:** Source 10.12.2.14, Destination 151.101.65.91, http:80
- **Additional evidence:** Packets: 716, 744, 759, 762 | Streams: 15 | Time: 2026-10-21 07:10:28 UTC – 2026-10-21 07:10:28 UTC | port=80, packets=10, payload_bytes=672, clients=['10.12.2.14'], client_count=1, external_server=True
- **Recommendation:** Require HTTPS for all device and cloud communication.
- **Finding ID:** `3b872ab0d3a1a494`
### 2. Clear-text protocol: HTTP on 192.178.194.102:80
- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
- **📍 Sources:**
- Packet #1307 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
- Packet #1308 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
- Packet #1309 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
- Packet #1310 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
- **Risk:** HTTP content is unencrypted and can be read or modified on the path.
- **Affected:** Source 10.12.2.14, Destination 192.178.194.102, http:80
- **Additional evidence:** Packets: 1307, 1308, 1309, 1310 | Streams: 30 | Time: 2026-10-21 07:10:36 UTC – 2026-10-21 07:10:36 UTC | port=80, packets=7, payload_bytes=312, clients=['10.12.2.14'], client_count=1, external_server=True
- **Recommendation:** Require HTTPS for all device and cloud communication.
- **Finding ID:** `401b185216f10382`
### 3. Clear-text protocol: HTTP on 10.12.2.17:80
- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
- **📍 Sources:**
- Packet #1632 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
- Packet #1659 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
- Packet #1711 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
- Packet #1712 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
- **Risk:** HTTP content is unencrypted and can be read or modified on the path.
- **Affected:** Source 10.12.2.14, Destination 10.12.2.17, http:80
- **Additional evidence:** Packets: 1632, 1659, 1711, 1712 | Streams: 39 | Time: 2026-10-21 07:10:38 UTC – 2026-10-21 07:10:39 UTC | port=80, packets=13, payload_bytes=221, clients=['10.12.2.14'], client_count=1, external_server=False
- **Recommendation:** Require HTTPS for all device and cloud communication.
- **Finding ID:** `a80245540240803f`
### 4. Overlong DNS label suggests tunneling
- **Severity:** MEDIUM · **Confidence:** low · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
- **🔎 Observed artifact:** `DNS query: d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com`
- **📍 Sources:**
- Packet #307 · 2026-10-21 07:10:14 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
- **Risk:** A DNS label of 63 characters was observed under a2z.com. Overlong labels are used to encode data in DNS tunnels.
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53, a2z.com
- **Additional evidence:** Packets: 307 | Time: 2026-10-21 07:10:14 UTC – 2026-10-21 07:10:14 UTC | registered_domain=a2z.com, query_name=d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com, label_length=63, device_related=False
- **Recommendation:** Review the destination domain and enable tunneling detection.
- **Finding ID:** `2bde55c6733c1b91`
### 5. DNS sent directly to an external resolver (8.8.8.8)
- **Severity:** LOW · **Confidence:** high · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
- **📍 Sources:**
- Packet #307 · 2026-10-21 07:10:14 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
- **Risk:** The host resolves names through a hard-coded external resolver instead of the one assigned by the network. Local DNS filtering and monitoring are bypassed and the queries are visible to a third party.
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53
- **Additional evidence:** Packets: 307 | Time: 2026-10-21 07:10:14 UTC – 2026-10-21 07:10:14 UTC | queries=28, device_related=False
- **Recommendation:** Use the DHCP-assigned resolver, or DNS over TLS/HTTPS if privacy is required.
- **Finding ID:** `b90cea9473b87e9a`
### 6. Randomly-structured DNS name observed
- **Severity:** LOW · **Confidence:** low · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
- **🔎 Observed artifact:** `Domain: mozilla.net`
- **📍 Sources:**
- Packet #673 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
- Packet #817 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
- Packet #818 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
- **Risk:** A DNS name with a random-looking label was queried under mozilla.net. In isolation this is a weak indicator; it becomes significant only alongside many such names or other anomalies.
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53, mozilla.net
- **Additional evidence:** Packets: 673, 817, 818 | Time: 2026-10-21 07:10:28 UTC – 2026-10-21 07:10:28 UTC | registered_domain=mozilla.net, distinct_random_subdomains=1, examples=['content-signature-2.cdn'], device_related=False
- **Recommendation:** Confirm the domain is a legitimate service; otherwise check it against threat intelligence.
- **Finding ID:** `bd7db6daa73bc8dc`
### 7. Device offers a network service on port 443
- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
- **📍 Sources:**
- ? → 34.95.90.149 · tls:443 · Capture init-925dbe660d8b.pcapng · aggregated evidence; no single packet is available
- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
- **Affected:** Device 34.95.90.149, Destination 34.95.90.149, tls:443 · **involves device under test**
- **Additional evidence:** Time: — – — | port=443, protocols=['tls'], device_related=True
- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise.
- **Finding ID:** `016728bd857643ed`
## Observation Inventory
- Capture: 3326 packets, 104.486 s, 4 internal and 23 external hosts, 82 flows, VLANs 1, 200 · extractor tshark 4.4.19
### Device under test
- `34.95.90.149` · MAC 52:54:00:3a:bf:97 · names —
- 138 packets · sent 83.1 kB · received 6.8 kB · first seen 2026-10-21 07:10:33 UTC · last seen 2026-10-21 07:10:39 UTC
- Services offered: 443 · ports contacted: —
- Protocols: tls · TLS sessions: 0 · clear-text flows: 0
- Peers (1):
- `10.12.2.14` (10-12-2-14.local) · internal · ports 46126, 46136, 55238, 55248 · tls · to peer 83.1 kB / from peer 6.8 kB
### Internal hosts (4)
- `10.12.2.14` · MAC 6e:bd:64:d7:9a:69 · 1628 packets · offers — · 22 external endpoints
- `10.12.2.17` · MAC 8c:4b:14:6a:1a:cc · 110 packets · offers 80 · 1 external endpoints
- `10.12.0.200` · MAC c8:7f:54:de:c0:38 · 59 packets · offers — · 1 external endpoints
- `10.12.0.250` · MAC 52:54:00:3a:bf:97 · 3 packets · offers 53 · 0 external endpoints
### External endpoints (23)
- `151.101.1.91` (firefox-portal-detection.com, merino.services.mozilla.com) · ports 443 · tls · encrypted · out 4.2 kB / in 100.7 kB
- `34.95.90.149` (control.shelly.cloud) · ports 443 · tls · encrypted · out 6.8 kB / in 83.1 kB
- `104.155.32.247` (shelly-120-eu.shelly.cloud) · ports 443, 6113 · tls · encrypted · out 32.1 kB / in 28.3 kB
- `34.155.200.196` (integrations.loqed.com) · ports 443, 8883 · tls · encrypted · out 8.7 kB / in 32.6 kB
- `34.54.185.247` (incoming.telemetry.mozilla.org) · ports 443 · tls · encrypted · out 25.4 kB / in 15.3 kB
- `192.178.194.139` (android.clients.google.com, play-fe.googleapis.com) · ports 443 · quic, tls · encrypted · out 18.3 kB / in 15.0 kB
- `3.91.171.220` (kinesis.us-east-1.amazonaws.com) · ports 443 · tls · encrypted · out 13.7 kB / in 15.6 kB
- `35.205.173.252` (app-ratings.shelly.cloud, paypal.shelly.cloud, shelly-infra1-eu.shelly.cloud) · ports 443, 9443 · tls · encrypted · out 9.6 kB / in 18.3 kB
- `34.62.47.252` (changelog-backend.shelly.cloud) · ports 443 · tls · encrypted · out 5.8 kB / in 21.7 kB
- `34.79.5.199` (shelly-101-eu.shelly.cloud) · ports 31234 · tls · encrypted · out 7.9 kB / in 19.4 kB
- `51.124.96.69` (app-api.cmap.abus.com) · ports 443 · tls · encrypted · out 11.5 kB / in 11.9 kB
- `34.117.64.196` (assets.mozilla.net) · ports 443 · tls · encrypted · out 5.6 kB / in 16.2 kB
- `100.50.70.74` (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · ports 443 · tls · encrypted · out 4.4 kB / in 11.0 kB
- `34.149.226.178` (content-signature-2.cdn.mozilla.net) · ports 443 · tls · encrypted · out 2.9 kB / in 11.3 kB
- `35.241.201.25` (repo.shelly.cloud) · ports 443 · tls · encrypted · out 2.6 kB / in 9.7 kB
- `192.178.194.95` (fonts.googleapis.com) · ports 443 · quic, tls · encrypted · out 4.4 kB / in 7.2 kB
- `142.251.27.94` (fonts.gstatic.com) · ports 443 · quic, tls · encrypted · out 4.3 kB / in 7.0 kB
- `142.251.150.120` (connectivitycheck.gstatic.com) · ports 443 · tls · encrypted · out 3.0 kB / in 8.1 kB
- `172.217.119.4` (play.googleapis.com, playstoregatewayadapter-pa.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com) · ports 443 · tls · encrypted · out 4.1 kB / in 6.1 kB
- `8.8.8.8` · ports 53 · dns · clear-text or unknown · out 2.5 kB / in 5.1 kB
- `151.101.65.91` (firefox-portal-detection.com, merino.services.mozilla.com) · ports 80 · http · clear-text or unknown · out 661 B / in 727 B
- `192.178.194.102` (android.clients.google.com, clients3.google.com, play-fe.googleapis.com) · ports 80 · http · clear-text or unknown · out 543 B / in 345 B
- `51.102.84.134` · ports 443 · undecoded · clear-text or unknown · out 70 B / in 0 B
### Services observed (29)
- `34.95.90.149:443` https (tcp) ← device · encrypted · 2 flows from 1 clients
- `10.12.0.200:53` dns (udp) · unknown · 1 flows from 1 clients
- `10.12.0.250:53` dns (udp) · unknown · 1 flows from 1 clients
- `10.12.2.17:80` http (tcp) · clear-text · 1 flows from 1 clients
- `100.50.70.74:443` https (tcp) · encrypted · 2 flows from 1 clients
- `104.155.32.247:443` https (tcp) · encrypted · 4 flows from 1 clients
- `104.155.32.247:6113` tls/6113 (tcp) · encrypted · 2 flows from 1 clients
- `142.251.150.120:443` https (tcp) · encrypted · 2 flows from 1 clients
- `142.251.27.94:443` quic (udp) · encrypted · 1 flows from 1 clients
- `151.101.1.91:443` https (tcp) · encrypted · 1 flows from 1 clients
- `151.101.65.91:80` http (tcp) · clear-text · 1 flows from 1 clients
- `172.217.119.4:443` https (tcp) · encrypted · 1 flows from 1 clients
- `192.178.194.102:80` http (tcp) · clear-text · 1 flows from 1 clients
- `192.178.194.139:443` https (tcp) · encrypted · 1 flows from 1 clients
- `192.178.194.139:443` quic (udp) · encrypted · 2 flows from 1 clients
- `192.178.194.95:443` quic (udp) · encrypted · 1 flows from 1 clients
- `3.91.171.220:443` https (tcp) · encrypted · 2 flows from 1 clients
- `34.117.64.196:443` https (tcp) · encrypted · 2 flows from 1 clients
- `34.149.226.178:443` https (tcp) · encrypted · 2 flows from 1 clients
- `34.155.200.196:443` https (tcp) · encrypted · 1 flows from 1 clients
- `34.155.200.196:8883` mqtts (tcp) · encrypted · 1 flows from 1 clients
- `34.54.185.247:443` https (tcp) · encrypted · 2 flows from 1 clients
- `34.62.47.252:443` https (tcp) · encrypted · 4 flows from 1 clients
- `34.79.5.199:31234` tls/31234 (tcp) · encrypted · 2 flows from 1 clients
- `35.205.173.252:443` https (tcp) · encrypted · 2 flows from 1 clients
- `35.205.173.252:9443` tls/9443 (tcp) · encrypted · 1 flows from 1 clients
- `35.241.201.25:443` https (tcp) · encrypted · 1 flows from 1 clients
- `51.124.96.69:443` https (tcp) · encrypted · 1 flows from 1 clients
- `8.8.8.8:53` dns (udp) · unknown · 28 flows from 1 clients
### Protocols (packets)
- ip 1784, arp 1542, tcp 1414, tls 588, udp 370, mdns 222, quic 89, dns 59, http 6, icmp 1
- ICMP: unreachable 1
### TLS posture (35 handshakes)
- Versions: TLS 1.3 ×23, TLS 1.2 ×12
- Cipher suites: TLS_AES_128_GCM_SHA256 ×14, TLS_AES_256_GCM_SHA384 ×9, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ×2, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ×8, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ×2
- 10.12.2.14 → `34.95.90.149:443` (control.shelly.cloud) ← device · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `34.95.90.149:443` (control.shelly.cloud) ← device · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `100.50.70.74:443` (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `100.50.70.74:443` (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `104.155.32.247:443` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `104.155.32.247:443` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `104.155.32.247:443` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `104.155.32.247:6113` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
- 10.12.2.14 → `142.251.150.120:443` (connectivitycheck.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `142.251.150.120:443` (connectivitycheck.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `142.251.27.94:443` (fonts.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `151.101.1.91:443` (merino.services.mozilla.com) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert merino.services.mozilla.com by YR1, expires 2026-12-25 12:57:43 UTC
- 10.12.2.14 → `172.217.119.4:443` (remoteprovisioning.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
- 10.12.2.14 → `192.178.194.139:443` (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
- 10.12.2.14 → `192.178.194.139:443` (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
- 10.12.2.14 → `192.178.194.139:443` (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
- 10.12.2.14 → `192.178.194.95:443` (fonts.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
- 10.12.2.14 → `3.91.171.220:443` (kinesis.us-east-1.amazonaws.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `3.91.171.220:443` (kinesis.us-east-1.amazonaws.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `34.117.64.196:443` (assets.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert cdn.website.assets-mozilla-net.prod.webservices.mozgcp.net by YR2, expires 2026-11-21 22:55:06 UTC
- 10.12.2.14 → `34.117.64.196:443` (assets.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert cdn.website.assets-mozilla-net.prod.webservices.mozgcp.net by YR2, expires 2026-11-21 22:55:06 UTC
- 10.12.2.14 → `34.149.226.178:443` (content-signature-2.cdn.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert content-signature-2.cdn.mozilla.net by YR2, expires 2026-12-23 09:28:57 UTC
- 10.12.2.14 → `34.149.226.178:443` (content-signature-2.cdn.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert content-signature-2.cdn.mozilla.net by YR2, expires 2026-12-23 09:28:57 UTC
- 10.12.2.14 → `34.155.200.196:443` (integrations.loqed.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
- 10.12.2.14 → `34.54.185.247:443` (incoming.telemetry.mozilla.org) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert incoming.telemetry.mozilla.org by DigiCert Global G2 TLS RSA SHA256 2020 CA1, expires 2026-11-19 23:59:59 UTC
- 10.12.2.14 → `34.54.185.247:443` (incoming.telemetry.mozilla.org) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.2.14 → `34.62.47.252:443` (changelog-backend.shelly.cloud) · TLS 1.2 · TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.3 · cert changelog-backend.shelly.cloud by YE1, expires 2026-12-20 09:03:22 UTC
- 10.12.2.14 → `34.62.47.252:443` (changelog-backend.shelly.cloud) · TLS 1.2 · TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.3 · cert changelog-backend.shelly.cloud by YE1, expires 2026-12-20 09:03:22 UTC
- 10.12.2.14 → `34.79.5.199:31234` (shelly-101-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
- 10.12.2.14 → `34.79.5.199:31234` (shelly-101-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
### DNS (176 queries, 30 responses, 25 names)
- Response codes: NOERROR 29, NXDOMAIN 1 · resolvers: 8.8.8.8 (28), 10.12.0.250 (1), 10.12.0.200 (1)
- `_http._tcp.local` · 60× · PTR · no answer seen
- `_shelly._tcp.local` · 60× · PTR · no answer seen
- `10-12-2-14.local` · 27× · ANY · no answer seen
- `firefox-portal-detection.com` · 3× · A, HTTPS · 151.101.1.91, 151.101.129.91, 151.101.193.91, 151.101.65.91
- `incoming.telemetry.mozilla.org` · 3× · A, HTTPS · 34.54.185.247
- `assets.mozilla.net` · 2× · A, HTTPS · 34.117.64.196
- `fonts.googleapis.com` · 2× · A, HTTPS · 192.178.194.95
- `merino.services.mozilla.com` · 2× · A, HTTPS · 151.101.1.91, 151.101.129.91, 151.101.193.91, 151.101.65.91
- `_31234._https.shelly-101-eu.shelly.cloud` · 1× · HTTPS · no answer seen
- `android.clients.google.com` · 1× · A · 142.251.27.102, 142.251.27.139, 172.217.168.142, 192.178.194.102, 192.178.194.138, 192.178.194.139
- `cloudflare-dns.com` · 1× · HTTPS · no answer seen
- `content-signature-2.cdn.mozilla.net` · 1× · HTTPS · no answer seen
- `d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com` · 1× · A · 100.31.167.60, 100.50.70.74, 13.216.221.160, 52.45.179.236
- `example.org` · 1× · A · 104.20.26.136, 172.66.157.237
- `fonts.gstatic.com` · 1× · HTTPS · no answer seen
- `i.ytimg.com` · 1× · A · 142.251.145.6, 142.251.147.6, 142.251.148.6, 142.251.149.6, 192.178.40.6, 192.178.41.6
- `integrations.loqed.com` · 1× · HTTPS · no answer seen
- `kinesis.us-east-1.amazonaws.com` · 1× · A · 3.91.171.220
- `play-fe.googleapis.com` · 1× · A · 192.178.194.100, 192.178.194.101, 192.178.194.102, 192.178.194.113, 192.178.194.138, 192.178.194.139
- `play-lh.googleusercontent.com` · 1× · A · 192.178.194.119
- `play.googleapis.com` · 1× · A · 172.217.113.4, 172.217.114.4, 172.217.115.4, 172.217.116.4, 172.217.118.4, 172.217.119.4
- `playstoregatewayadapter-pa.googleapis.com` · 1× · A · 172.217.112.4, 172.217.114.4, 172.217.116.4, 172.217.117.4, 172.217.118.4, 172.217.119.4
- `prod-lt-playstoregatewayadapter-pa.googleapis.com` · 1× · A · 172.217.112.4, 172.217.113.4, 172.217.114.4, 172.217.115.4, 172.217.117.4, 172.217.118.4
- `remoteprovisioning.googleapis.com` · 1× · A · 172.217.112.4, 172.217.113.4, 172.217.114.4, 172.217.117.4, 172.217.118.4, 172.217.119.4
- `shelly-101-eu.shelly.cloud` · 1× · A · 34.79.5.199
### HTTP (6 requests)
- `10.12.2.14` · 3 requests · · /success.txt?ipv4, /generate_204, /shelly
- `firefox-portal-detection.com` · 1 requests · GET · /success.txt?ipv4
- `clients3.google.com` · 1 requests · GET · /generate_204
- `10.12.2.17` · 1 requests · GET · /shelly
### Clear-text protocols and service events
- http: 3 flows, 1.2 kB · 10.12.2.14 -> 10.12.2.17:80; 10.12.2.14 -> 151.101.65.91:80; 10.12.2.14 -> 192.178.194.102:80
### Coverage
- Complete extraction · 82 flows, 40 encrypted, 0 with undecoded payload · 18 clear-text payloads scanned
- 23 TLS 1.3 sessions: server certificates are encrypted and could not be inspected.
## Cloud URLs and Endpoints (38)
- `10-12-2-14.local` — Ports: —; TLS: N/A; Cipher: N/A
- `10.12.2.17` — Ports: —; TLS: N/A; Cipher: N/A
- `51.102.84.134` — Ports: 443, 8000; TLS: N/A; Cipher: N/A
- `8.8.8.8` — Ports: 53, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `_31234._https.shelly-101-eu.shelly.cloud` — Ports: —; TLS: N/A; Cipher: N/A
- `_http._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
- `_shelly._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
- `android.clients.google.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `app-api.cmap.abus.com` — Ports: 80, 443; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-SHA384
- `app-ratings.shelly.cloud` — Ports: 22, 80, 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384
- `assets.mozilla.net` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `changelog-backend.shelly.cloud` — Ports: 22, 80, 443; TLS: TLSv1.2; Cipher: ECDHE-ECDSA-AES256-GCM-SHA384
- `clients3.google.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `cloudflare-dns.com` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `connectivitycheck.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `content-signature-2.cdn.mozilla.net` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `control.shelly.cloud` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `example.org` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `firefox-portal-detection.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `fonts.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `fonts.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `i.ytimg.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `incoming.telemetry.mozilla.org` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `integrations.loqed.com` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `kinesis.us-east-1.amazonaws.com` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `merino.services.mozilla.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `paypal.shelly.cloud` — Ports: 22, 80, 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384
- `play-fe.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `play-lh.googleusercontent.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `play.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `playstoregatewayadapter-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `prod-lt-playstoregatewayadapter-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `remoteprovisioning.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `repo.shelly.cloud` — Ports: 22, 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `shelly-101-eu.shelly.cloud` — Ports: 22, 80, 443, 31234; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `shelly-120-eu.shelly.cloud` — Ports: 22, 80, 443, 6113; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `shelly-infra1-eu.shelly.cloud` — Ports: 22, 80, 443, 8000, 9443; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384
---
_Generated by IoT PreTester 4.6 · Detectors: PlaintextCredentialDetector, PasswordHashDetector, TokenSecretDetector, MalwareBeaconingDetector, ExfiltrationDetector, MitmDetector, InsecureProtocolDetector, TlsWeaknessDetector, DnsAnomalyDetector, BruteforceScanFileTransferDetector_
pretester_reports/old_init_report.md
+406
View File
@@ -0,0 +1,406 @@
# IoT PreTester 4.6 — Network Capture Security Analysis
- **Capture:** `/app/files/uploads/old_init-2d7aed437f3d.pcapng`
- **Packets:** 12383 · **Duration:** 331.027 s · **Findings:** 7
- **Device under test:** `34.155.200.196` (MAC 52:54:00:71:bb:02) · device-related findings: 3, other hosts: 4
## Summary
| Severity | Count |
| ----------- | ------ |
| CRITICAL | 0 |
| HIGH | 0 |
| MEDIUM | 1 |
| LOW | 4 |
| INFO | 2 |
## Findings
### 1. Clear-text protocol: HTTP on 142.250.154.94:80
- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
- **📍 Sources:**
- Packet #5211 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
- Packet #5215 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
- Packet #5219 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
- Packet #5222 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
- **Risk:** HTTP content is unencrypted and can be read or modified on the path.
- **Affected:** Source 10.12.0.103, Destination 142.250.154.94, http:80
- **Additional evidence:** Packets: 5211, 5215, 5219, 5222 | Streams: 134 | Time: 2026-07-08 08:44:30 UTC – 2026-07-08 08:44:30 UTC | port=80, packets=10, payload_bytes=373, clients=['10.12.0.103'], client_count=1, external_server=True
- **Recommendation:** Require HTTPS for all device and cloud communication.
- **Finding ID:** `d31487f489fcc8f4`
### 2. Many small outbound connections to one target
- **Severity:** LOW · **Confidence:** low · **Category:** exfiltration · **Detector:** ExfiltrationDetector
- **📍 Sources:**
- Packet #22 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
- Packet #56 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
- Packet #92 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
- Packet #127 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
- Packet #163 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
- Packet #200 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
- Packet #236 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
- Packet #288 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
- … and 270 more packets
- **Risk:** Many short outbound connections to one target may indicate segmented uploads or polling.
- **Affected:** Device 34.155.200.196, Source 10.12.0.103, Destination 34.155.200.196 · **involves device under test**
- **Additional evidence:** Packets: 22, 56, 92, 127, 163, 200, 236, 288 | Streams: 3, 4, 5, 6, 7, 8, 9, 13 | Time: — – — | transfer_count=278, target_names=['api.production.loqed.com', 'mqtt.production.loqed.com'], device_related=True
- **Recommendation:** Investigate the connection pattern and destination.
- **Finding ID:** `fba18730143d6ee7`
### 3. Client offers broken cipher suites
- **Severity:** LOW · **Confidence:** high · **Category:** tls_weakness · **Detector:** TlsWeaknessDetector
- **📍 Sources:**
- Packet #4086 · 2026-07-08 08:43:36 UTC · 10.12.0.102 → 17.167.200.74 · tls:443 · Capture old_init-2d7aed437f3d.pcapng
- **Risk:** The client advertises cipher suites with known weaknesses. A downgrade or a misconfigured server could select one of them.
- **Affected:** Source 10.12.0.102, Destination 17.167.200.74, tls:443, gsp85-ssl.ls.apple.com
- **Additional evidence:** Packets: 4086 | Time: 2026-07-08 08:43:36 UTC – 2026-07-08 08:43:36 UTC | weak_ciphers=['TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))', 'TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))', 'TLS_RSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))'], offered_total=20, target=gsp85-ssl.ls.apple.com, device_related=False
- **Recommendation:** Remove obsolete cipher suites from the client's TLS configuration.
- **Finding ID:** `9edddf1d281cdabd`
### 4. DNS sent directly to an external resolver (8.8.8.8)
- **Severity:** LOW · **Confidence:** high · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
- **📍 Sources:**
- Packet #1020 · 2026-07-08 08:41:06 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
- **Risk:** The host resolves names through a hard-coded external resolver instead of the one assigned by the network. Local DNS filtering and monitoring are bypassed and the queries are visible to a third party.
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53
- **Additional evidence:** Packets: 1020 | Time: 2026-07-08 08:41:06 UTC – 2026-07-08 08:41:06 UTC | queries=12, device_related=False
- **Recommendation:** Use the DHCP-assigned resolver, or DNS over TLS/HTTPS if privacy is required.
- **Finding ID:** `b90cea9473b87e9a`
### 5. Randomly-structured DNS name observed
- **Severity:** LOW · **Confidence:** low · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
- **🔎 Observed artifact:** `Domain: intercom.com`
- **📍 Sources:**
- Packet #1020 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
- Packet #1021 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
- Packet #6965 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
- Packet #6966 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
- **Risk:** A DNS name with a random-looking label was queried under intercom.com. In isolation this is a weak indicator; it becomes significant only alongside many such names or other anomalies.
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53, intercom.com
- **Additional evidence:** Packets: 1020, 1021, 6965, 6966 | Time: 2026-07-08 08:41:06 UTC – 2026-07-08 08:41:06 UTC | registered_domain=intercom.com, distinct_random_subdomains=1, examples=['n1cez2fg-android.mobile-messenger'], device_related=False
- **Recommendation:** Confirm the domain is a legitimate service; otherwise check it against threat intelligence.
- **Finding ID:** `26d5761b2c0d5e1c`
### 6. Device offers a network service on port 443
- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
- **📍 Sources:**
- ? → 34.155.200.196 · tls:443 · Capture old_init-2d7aed437f3d.pcapng · aggregated evidence; no single packet is available
- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
- **Affected:** Device 34.155.200.196, Destination 34.155.200.196, tls:443 · **involves device under test**
- **Additional evidence:** Time: — – — | port=443, protocols=['tls'], device_related=True
- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise.
- **Finding ID:** `9080003b793ca322`
### 7. Device offers a network service on port 8883
- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
- **📍 Sources:**
- ? → 34.155.200.196 · tls:8883 · Capture old_init-2d7aed437f3d.pcapng · aggregated evidence; no single packet is available
- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
- **Affected:** Device 34.155.200.196, Destination 34.155.200.196, tls:8883 · **involves device under test**
- **Additional evidence:** Time: — – — | port=8883, protocols=['tls'], device_related=True
- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise.
- **Finding ID:** `e033c2ed522bde4e`
## Observation Inventory
- Capture: 12383 packets, 331.027 s, 10 internal and 37 external hosts, 410 flows, VLANs 1, 200 · extractor tshark 4.4.19
### Device under test
- `34.155.200.196` · MAC 52:54:00:71:bb:02 · names —
- 9968 packets · sent 1.4 MB · received 736.6 kB · first seen 2026-07-08 08:40:37 UTC · last seen 2026-07-08 08:46:01 UTC
- Services offered: 443, 8883 · ports contacted: —
- Protocols: tls · TLS sessions: 0 · clear-text flows: 0
- Peers (2):
- `10.12.0.103` · internal · ports 33854, 33856, 33870, 33876, 33880, 33896, 33912, 33922, 33926, 33940, 33956, 33960, 33970, 33982, 33996, 34002, 34016, 34020, 34032, 34038 · tls · to peer 1.4 MB / from peer 732.2 kB
- `10.12.0.104` (loqed-8c4b146a1acc._http._tcp.local) · internal · ports 50167 · tls · to peer 6.7 kB / from peer 4.5 kB
### Internal hosts (10)
- `10.12.0.103` · MAC 6e:bd:64:d7:9a:69 · 11149 packets · offers 33054, 53758, 53770, 53772, 53778, 53794, 53808, 55340 · 19 external endpoints
- `10.12.0.102` (iphone) · MAC d6:cd:eb:e5:d1:75 · 697 packets · offers — · 14 external endpoints
- `10.12.0.104` (loqed-8c4b146a1acc) · MAC 8c:4b:14:6a:1a:cc · 275 packets · offers — · 3 external endpoints
- `10.12.0.250` · MAC 52:54:00:71:bb:02 · 106 packets · offers 53 · 0 external endpoints
- `fe80::10f6:c22e:fe1c:d27a` (iphone) · MAC d6:cd:eb:e5:d1:75 · 63 packets · offers — · 0 external endpoints
- `10.12.0.200` · MAC c8:7f:54:de:c0:38 · 42 packets · offers — · 1 external endpoints
- `fe80::6cbd:64ff:fed7:9a69` · MAC 6e:bd:64:d7:9a:69 · 39 packets · offers — · 0 external endpoints
- `fe80::ca7f:54ff:fede:c038` · MAC c8:7f:54:de:c0:38 · 4 packets · offers — · 0 external endpoints
- `192.168.42.75` · MAC — · 4 packets · offers — · 0 external endpoints
- `10.12.0.101` · MAC — · 2 packets · offers — · 1 external endpoints
### External endpoints (37)
- `34.155.200.196` (api.production.loqed.com, mqtt.production.loqed.com) · ports 443, 8883 · tls · encrypted · out 736.6 kB / in 1.4 MB
- `17.253.57.197` (captive.apple.com, cl2.apple.com) · ports 443 · tls · encrypted · out 8.6 kB / in 251.1 kB
- `216.239.36.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · quic, tls · encrypted · out 54.2 kB / in 179.6 kB
- `142.251.127.101` (encrypted-tbn0.gstatic.com) · ports 443 · tls · encrypted · out 16.0 kB / in 207.8 kB
- `142.251.152.119` (www.google.com) · ports 443 · tls · encrypted · out 5.4 kB / in 95.1 kB
- `142.251.110.95` (www.googleapis.com) · ports 443 · quic, tls · encrypted · out 10.8 kB / in 88.9 kB
- `142.251.13.113` (encrypted-tbn1.gstatic.com) · ports 443 · tls · encrypted · out 7.1 kB / in 33.2 kB
- `142.250.154.139` (encrypted-tbn3.gstatic.com) · ports 443 · tls · encrypted · out 6.4 kB / in 16.7 kB
- `17.57.146.56` (25-courier.push.apple.com, courier.push.apple.com) · ports 5223 · tls · encrypted · out 16.8 kB / in 6.1 kB
- `199.232.191.6` (bag.itunes.apple.com) · ports 443 · quic, tls · encrypted · out 6.0 kB / in 16.5 kB
- `216.239.38.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · quic, tls · encrypted · out 11.7 kB / in 10.1 kB
- `40.104.206.18` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 7.1 kB / in 14.1 kB
- `98.90.70.94` (n1cez2fg-android.mobile-messenger.intercom.com) · ports 443 · tls · encrypted · out 4.8 kB / in 15.6 kB
- `17.248.209.81` (gateway.icloud.com) · ports 443, 61000 · icmp, quic, tls · encrypted · out 11.4 kB / in 8.6 kB
- `216.239.34.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · tls · encrypted · out 5.6 kB / in 10.6 kB
- `172.224.55.5` (mask.icloud.com) · ports 443 · quic, tls · encrypted · out 8.3 kB / in 7.8 kB
- `54.144.197.43` (n1cez2fg-android.mobile-messenger.intercom.com) · ports 443 · tls · encrypted · out 3.7 kB / in 9.2 kB
- `17.188.143.125` (init.push.apple.com) · ports 443 · tls · encrypted · out 2.5 kB / in 8.1 kB
- `17.253.57.195` (captive.apple.com, cl2.apple.com) · ports 443 · tls · encrypted · out 2.4 kB / in 7.5 kB
- `17.253.15.139` (configuration.ls.apple.com) · ports 443 · tls · encrypted · out 2.8 kB / in 6.7 kB
- `17.167.200.74` (gsp85-ssl.ls.apple.com) · ports 443 · tls · encrypted · out 3.0 kB / in 5.8 kB
- `18.97.36.75` (nexus-websocket-a.intercom.io) · ports 443 · tls · encrypted · out 2.2 kB / in 6.5 kB
- `2.16.16.110` (gspe1-ssl.ls.apple.com) · ports 443 · tls · encrypted · out 3.8 kB / in 4.9 kB
- `63.181.149.124` (hooks.nabu.casa) · ports 443 · tls · encrypted · out 1.9 kB / in 5.6 kB
- `142.250.154.94` (connectivitycheck.gstatic.com) · ports 80, 443 · http, tls · encrypted · out 2.1 kB / in 4.6 kB
- `142.251.20.113` · ports 443 · tls · encrypted · out 3.4 kB / in 2.4 kB
- `40.101.70.194` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
- `52.97.105.162` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
- `40.101.69.226` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
- `8.8.8.8` · ports 53, 59560 · dns, icmp · clear-text or unknown · out 1.2 kB / in 1.9 kB
- `142.251.157.119` (www.google.com) · ports 443 · tls · encrypted · out 1.5 kB / in 1.6 kB
- `18.97.36.19` · ports 443 · tls · encrypted · out 350 B / in 446 B
- `142.251.127.188` · ports 5228 · tls · encrypted · out 166 B / in 164 B
- `31.13.84.49` · ports 5222 · undecoded · clear-text or unknown · out 0 B / in 236 B
- `3.91.171.254` · ports 443 · tls · encrypted · out 164 B / in 58 B
- `91.206.8.34` (pool.ntp.org) · ports 123 · ntp · clear-text or unknown · out 94 B / in 94 B
- `142.251.156.119` (www.google.com) · ports 443 · undecoded · clear-text or unknown · out 70 B / in 58 B
### Services observed (45)
- `34.155.200.196:443` https (tcp) ← device · encrypted · 277 flows from 1 clients
- `34.155.200.196:8883` mqtts (tcp) ← device · encrypted · 1 flows from 1 clients
- `10.12.0.102:443` https (udp) · unknown · 1 flows from 1 clients
- `10.12.0.200:53` dns (udp) · unknown · 6 flows from 2 clients
- `10.12.0.250:53` dns (udp) · unknown · 48 flows from 4 clients
- `142.250.154.139:443` https (tcp) · encrypted · 2 flows from 1 clients
- `142.250.154.94:80` http (tcp) · clear-text · 1 flows from 1 clients
- `142.250.154.94:443` https (tcp) · encrypted · 1 flows from 1 clients
- `142.251.110.95:443` quic (udp) · encrypted · 1 flows from 1 clients
- `142.251.127.101:443` https (tcp) · encrypted · 4 flows from 1 clients
- `142.251.127.188:5228` gcm (tcp) · encrypted · 1 flows from 1 clients
- `142.251.13.113:443` https (tcp) · encrypted · 2 flows from 1 clients
- `142.251.152.119:443` https (tcp) · encrypted · 1 flows from 1 clients
- `142.251.156.119:443` https (tcp) · unknown · 1 flows from 1 clients
- `142.251.157.119:443` https (tcp) · encrypted · 1 flows from 1 clients
- `142.251.20.113:443` https (tcp) · encrypted · 5 flows from 1 clients
- `17.167.200.74:443` https (tcp) · encrypted · 1 flows from 1 clients
- `17.188.143.125:443` https (tcp) · encrypted · 1 flows from 1 clients
- `17.248.209.81:443` quic (udp) · encrypted · 1 flows from 1 clients
- `17.253.15.139:443` https (tcp) · encrypted · 1 flows from 1 clients
- `17.253.57.195:443` https (tcp) · encrypted · 1 flows from 1 clients
- `17.253.57.197:443` https (tcp) · encrypted · 1 flows from 1 clients
- `17.57.146.56:5223` apns (tcp) · encrypted · 1 flows from 1 clients
- `172.224.55.5:443` quic (udp) · encrypted · 1 flows from 1 clients
- `172.224.55.5:443` https (tcp) · encrypted · 1 flows from 1 clients
- `18.97.36.19:443` https (tcp) · encrypted · 1 flows from 1 clients
- `18.97.36.75:443` https (tcp) · encrypted · 1 flows from 1 clients
- `199.232.191.6:443` quic (udp) · encrypted · 1 flows from 1 clients
- `2.16.16.110:443` https (tcp) · encrypted · 1 flows from 1 clients
- `216.239.34.223:443` https (tcp) · encrypted · 7 flows from 1 clients
- `216.239.36.223:443` quic (udp) · encrypted · 2 flows from 1 clients
- `216.239.38.223:443` https (tcp) · encrypted · 2 flows from 1 clients
- `216.239.38.223:443` quic (udp) · encrypted · 1 flows from 1 clients
- `3.91.171.254:443` https (tcp) · encrypted · 1 flows from 1 clients
- `31.13.84.49:5222` xmpp (tcp) · unknown · 1 flows from 1 clients
- `40.101.69.226:443` quic (udp) · encrypted · 1 flows from 1 clients
- `40.101.70.194:443` quic (udp) · encrypted · 1 flows from 1 clients
- `40.104.206.18:443` quic (udp) · encrypted · 1 flows from 1 clients
- `40.104.206.18:443` https (tcp) · encrypted · 1 flows from 1 clients
- `52.97.105.162:443` quic (udp) · encrypted · 1 flows from 1 clients
- `54.144.197.43:443` https (tcp) · encrypted · 1 flows from 1 clients
- `63.181.149.124:443` https (tcp) · encrypted · 1 flows from 1 clients
- `8.8.8.8:53` dns (udp) · unknown · 12 flows from 1 clients
- `91.206.8.34:123` ntp (udp) · unknown · 1 flows from 1 clients
- `98.90.70.94:443` https (tcp) · encrypted · 1 flows from 1 clients
### Protocols (packets)
- ip 12180, tcp 11373, tls 5469, udp 879, quic 541, mdns 189, dns 126, ipv6 115, arp 79, icmpv6 28, dhcp 20, igmp 15, icmp 7, ipv6.hopopts 6, http 2, ntp 2
- ICMP: router_advertisement 3, unreachable 7, router_solicitation 12, neighbor_solicitation 6, icmpv6_type_143 6, neighbor_advertisement 1
### TLS posture (320 handshakes)
- Versions: TLS 1.2 ×285, TLS 1.3 ×30
- Cipher suites: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ×284, TLS_AES_128_GCM_SHA256 ×12, TLS_AES_256_GCM_SHA384 ×18, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ×1
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
### DNS (129 queries, 66 responses, 46 names)
- Response codes: NOERROR 60, NXDOMAIN 6 · resolvers: 8.8.8.8 (12), 10.12.0.250 (48), 10.12.0.200 (6)
- `_rdlink._tcp.local` · 21× · PTR · no answer seen
- `1225c5c3-e802-4057-a9d9-4c2aa8527e4d._asquic._udp.local` · 18× · ANY · no answer seen
- `i0jzqvr8n14aaa._fc9f5ed42c8a._tcp.local` · 18× · ANY · no answer seen
- `loqed-8c4b146a1acc._http._tcp.local` · 12× · ANY · no answer seen
- `n1cez2fg-android.mobile-messenger.intercom.com` · 4× · A · 100.60.6.237, 107.20.239.244, 52.70.57.139, 54.144.197.43, 54.210.239.62, 98.90.70.94
- `www.google.com` · 3× · A · 142.251.150.119, 142.251.151.119, 142.251.152.119, 142.251.153.119, 142.251.154.119, 142.251.155.119
- `25-courier.push.apple.com` · 2× · A, HTTPS · 17.57.146.54, 17.57.146.55, 17.57.146.56, 17.57.146.57, 17.57.146.58, 17.57.146.59
- `bag.itunes.apple.com` · 2× · A, HTTPS · 199.232.191.6
- `captive.apple.com` · 2× · A, HTTPS · 17.253.57.195, 17.253.57.197
- `cl2.apple.com` · 2× · A, HTTPS · 17.253.57.195, 17.253.57.197
- `configuration.ls.apple.com` · 2× · A, HTTPS · 17.253.15.139, 17.253.15.147
- `connectivitycheck.gstatic.com` · 2× · A · 142.250.154.94, 142.251.20.94
- `gsp85-ssl.ls.apple.com` · 2× · A, HTTPS · 17.167.200.74
- `gspe1-ssl.ls.apple.com` · 2× · A, HTTPS · 2.16.16.100, 2.16.16.110
- `init.push.apple.com` · 2× · A, HTTPS · 17.188.143.125, 17.188.143.126, 17.188.143.189, 17.188.178.226, 17.188.178.34, 17.188.179.2
- `m.hotmail.com` · 2× · A, HTTPS · 40.101.69.226, 40.101.70.194, 40.104.206.18, 52.97.105.162
- `mask.icloud.com` · 2× · A, HTTPS · 172.224.55.10, 172.224.55.11, 172.224.55.13, 172.224.55.4, 172.224.55.5, 172.224.55.7
- `nexus-websocket-a.intercom.io` · 2× · A · 18.97.36.13, 18.97.36.14, 18.97.36.18, 18.97.36.2, 18.97.36.47, 18.97.36.49
- `www.googleapis.com` · 2× · A · 142.250.154.95, 142.251.110.95, 142.251.127.95, 142.251.13.95, 142.251.14.95, 142.251.20.95
- `_dns.resolver.arpa` · 1× · SVCB · no answer seen
- `a1366.dscapi6.akamai.net` · 1× · HTTPS · no answer seen
- `api.production.loqed.com` · 1× · A · 34.155.200.196
- `captive.g.aaplimg.com` · 1× · HTTPS · no answer seen
- `cl2.g.aaplimg.com` · 1× · HTTPS · no answer seen
- `configuration.ls.v.aaplimg.com` · 1× · HTTPS · no answer seen
- `discover-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
- `encrypted-tbn0.gstatic.com` · 1× · A · 142.251.127.100, 142.251.127.101, 142.251.127.102, 142.251.127.113, 142.251.127.138, 142.251.127.139
- `encrypted-tbn1.gstatic.com` · 1× · A · 142.251.13.100, 142.251.13.101, 142.251.13.102, 142.251.13.113, 142.251.13.138, 142.251.13.139
- `encrypted-tbn3.gstatic.com` · 1× · A · 142.250.154.100, 142.250.154.101, 142.250.154.102, 142.250.154.113, 142.250.154.138, 142.250.154.139
- `eu-central-courier-4.push-apple.com.akadns.net` · 1× · HTTPS · no answer seen
- `gsp85-ssl.ls2-apple.com.akadns.net` · 1× · HTTPS · no answer seen
- `hooks.nabu.casa` · 1× · A · 3.73.212.91, 63.181.149.124
- `init.push-apple.com.akadns.net` · 1× · HTTPS · no answer seen
- `lb._dns-sd._udp.0.0.12.10.in-addr.arpa` · 1× · PTR · no answer seen
- `lb._dns-sd._udp.15.89.76.100.in-addr.arpa` · 1× · PTR · no answer seen
- `lb._dns-sd._udp.56.111.171.10.in-addr.arpa` · 1× · PTR · no answer seen
- `lb._dns-sd._udp.6.0.0.192.in-addr.arpa` · 1× · PTR · no answer seen
- `lb._dns-sd._udp.jrz-iot.mci.edu` · 1× · PTR · no answer seen
- `mask.apple-dns.net` · 1× · HTTPS · no answer seen
- `mqtt.production.loqed.com` · 1× · A · 34.155.200.196
- `play.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
- `pool.ntp.org` · 1× · A · 152.53.100.131, 152.53.119.76, 46.102.157.67, 91.206.8.34
- `prod-lt-playstoregatewayadapter-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
- `remoteprovisioning.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
- `spot-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
- `vie-efz.ms-acdc.office.com` · 1× · HTTPS · no answer seen
### HTTP (2 requests)
- `connectivitycheck.gstatic.com` · 1 requests · GET · /generate_204
- `10.12.0.103` · 1 requests · · /generate_204
### Clear-text protocols and service events
- http: 1 flows, 373 B · 10.12.0.103 -> 142.250.154.94:80
- xmpp: 1 flows, 96 B · 10.12.0.101 -> 31.13.84.49:5222
- https: 1 flows, 21 B · 17.248.209.81 -> 10.12.0.102:443
- icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1)
- icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1)
- icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1)
- DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —)
- DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —)
- DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —)
- DHCP ack: d6:cd:eb:e5:d1:75 iphone → 10.12.0.102 (server 10.12.0.250)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
- DHCP offer: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
- DHCP ack: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
- DHCP offer: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
- DHCP ack: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
### Coverage
- Complete extraction · 410 flows, 330 encrypted, 1 with undecoded payload · 4 clear-text payloads scanned
- Undecoded ports (flows): 5222: 1
- Flows with application data that tshark did not decode (port: flows): 5222: 1
- 30 TLS 1.3 sessions: server certificates are encrypted and could not be inspected.
## Cloud URLs and Endpoints (54)
- `1225c5c3-e802-4057-a9d9-4c2aa8527e4d._asquic._udp.local` — Ports: —; TLS: N/A; Cipher: N/A
- `142.251.127.188` — Ports: 443, 5228; TLS: N/A; Cipher: N/A
- `142.251.20.113` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `18.97.36.19` — Ports: —; TLS: N/A; Cipher: N/A
- `25-courier.push.apple.com` — Ports: 443; TLS: N/A; Cipher: N/A
- `3.91.171.254` — Ports: 443; TLS: N/A; Cipher: N/A
- `31.13.84.49` — Ports: 80, 443, 5222; TLS: N/A; Cipher: N/A
- `8.8.8.8` — Ports: 53, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `_dns.resolver.arpa` — Ports: —; TLS: N/A; Cipher: N/A
- `_rdlink._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
- `a1366.dscapi6.akamai.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `api.production.loqed.com` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `bag.itunes.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `captive.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `captive.g.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `cl2.apple.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `cl2.g.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `configuration.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `configuration.ls.v.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `connectivitycheck.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `courier.push.apple.com` — Ports: 443, 5223; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `discover-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `encrypted-tbn0.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `encrypted-tbn1.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `encrypted-tbn3.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `eu-central-courier-4.push-apple.com.akadns.net` — Ports: 443; TLS: N/A; Cipher: N/A
- `gateway.icloud.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `gsp85-ssl.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `gsp85-ssl.ls2-apple.com.akadns.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `gspe1-ssl.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `hooks.nabu.casa` — Ports: 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES128-GCM-SHA256
- `i0jzqvr8n14aaa._fc9f5ed42c8a._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
- `init.push-apple.com.akadns.net` — Ports: 443; TLS: N/A; Cipher: N/A
- `init.push.apple.com` — Ports: 443; TLS: N/A; Cipher: N/A
- `lb._dns-sd._udp.0.0.12.10.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
- `lb._dns-sd._udp.15.89.76.100.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
- `lb._dns-sd._udp.56.111.171.10.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
- `lb._dns-sd._udp.6.0.0.192.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
- `lb._dns-sd._udp.jrz-iot.mci.edu` — Ports: —; TLS: N/A; Cipher: N/A
- `loqed-8c4b146a1acc._http._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
- `m.hotmail.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `mask.apple-dns.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `mask.icloud.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `mqtt.production.loqed.com` — Ports: 80, 443, 8080, 8883; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `n1cez2fg-android.mobile-messenger.intercom.com` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
- `nexus-websocket-a.intercom.io` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `play.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `pool.ntp.org` — Ports: 22; TLS: N/A; Cipher: N/A
- `prod-lt-playstoregatewayadapter-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `remoteprovisioning.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `spot-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `vie-efz.ms-acdc.office.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
- `www.google.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
- `www.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
---
_Generated by IoT PreTester 4.6 · Detectors: PlaintextCredentialDetector, PasswordHashDetector, TokenSecretDetector, MalwareBeaconingDetector, ExfiltrationDetector, MitmDetector, InsecureProtocolDetector, TlsWeaknessDetector, DnsAnomalyDetector, BruteforceScanFileTransferDetector_