a.edenhauser/Shelly-Loqed-Touch
1
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
20dfd8ba2bd2824bef033f820df720bf60e00e81
Shelly-Loqed-Touch/network/pretester_reports/init_report.md
T

25 KiB
Raw Blame History

IoT PreTester 4.6 — Network Capture Security Analysis

  • Capture: /app/files/uploads/init-925dbe660d8b.pcapng
  • Packets: 3326 · Duration: 104.486 s · Findings: 7
  • Device under test: 34.95.90.149 (MAC 52:54:00:3a:bf:97) · device-related findings: 1, other hosts: 6

Summary

Severity Count
CRITICAL 0
HIGH 0
MEDIUM 4
LOW 2
INFO 1

Findings

1. Clear-text protocol: HTTP on 151.101.65.91:80

  • Severity: MEDIUM · Confidence: high · Category: insecure_protocol · Detector: InsecureProtocolDetector
  • 📍 Sources:
    • Packet #716 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
    • Packet #744 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
    • Packet #759 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
    • Packet #762 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
  • Risk: HTTP content is unencrypted and can be read or modified on the path.
  • Affected: Source 10.12.2.14, Destination 151.101.65.91, http:80
  • Additional evidence: Packets: 716, 744, 759, 762 | Streams: 15 | Time: 2026-10-21 07:10:28 UTC – 2026-10-21 07:10:28 UTC | port=80, packets=10, payload_bytes=672, clients=['10.12.2.14'], client_count=1, external_server=True
  • Recommendation: Require HTTPS for all device and cloud communication.
  • Finding ID: 3b872ab0d3a1a494

2. Clear-text protocol: HTTP on 192.178.194.102:80

  • Severity: MEDIUM · Confidence: high · Category: insecure_protocol · Detector: InsecureProtocolDetector
  • 📍 Sources:
    • Packet #1307 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
    • Packet #1308 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
    • Packet #1309 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
    • Packet #1310 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
  • Risk: HTTP content is unencrypted and can be read or modified on the path.
  • Affected: Source 10.12.2.14, Destination 192.178.194.102, http:80
  • Additional evidence: Packets: 1307, 1308, 1309, 1310 | Streams: 30 | Time: 2026-10-21 07:10:36 UTC – 2026-10-21 07:10:36 UTC | port=80, packets=7, payload_bytes=312, clients=['10.12.2.14'], client_count=1, external_server=True
  • Recommendation: Require HTTPS for all device and cloud communication.
  • Finding ID: 401b185216f10382

3. Clear-text protocol: HTTP on 10.12.2.17:80

  • Severity: MEDIUM · Confidence: high · Category: insecure_protocol · Detector: InsecureProtocolDetector
  • 📍 Sources:
    • Packet #1632 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
    • Packet #1659 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
    • Packet #1711 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
    • Packet #1712 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
  • Risk: HTTP content is unencrypted and can be read or modified on the path.
  • Affected: Source 10.12.2.14, Destination 10.12.2.17, http:80
  • Additional evidence: Packets: 1632, 1659, 1711, 1712 | Streams: 39 | Time: 2026-10-21 07:10:38 UTC – 2026-10-21 07:10:39 UTC | port=80, packets=13, payload_bytes=221, clients=['10.12.2.14'], client_count=1, external_server=False
  • Recommendation: Require HTTPS for all device and cloud communication.
  • Finding ID: a80245540240803f

4. Overlong DNS label suggests tunneling

  • Severity: MEDIUM · Confidence: low · Category: dns_anomaly · Detector: DnsAnomalyDetector
  • 🔎 Observed artifact: DNS query: d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com
  • 📍 Sources:
    • Packet #307 · 2026-10-21 07:10:14 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
  • Risk: A DNS label of 63 characters was observed under a2z.com. Overlong labels are used to encode data in DNS tunnels.
  • Affected: Source 10.12.0.200, Destination 8.8.8.8, dns:53, a2z.com
  • Additional evidence: Packets: 307 | Time: 2026-10-21 07:10:14 UTC – 2026-10-21 07:10:14 UTC | registered_domain=a2z.com, query_name=d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com, label_length=63, device_related=False
  • Recommendation: Review the destination domain and enable tunneling detection.
  • Finding ID: 2bde55c6733c1b91

5. DNS sent directly to an external resolver (8.8.8.8)

  • Severity: LOW · Confidence: high · Category: dns_anomaly · Detector: DnsAnomalyDetector
  • 📍 Sources:
    • Packet #307 · 2026-10-21 07:10:14 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
  • Risk: The host resolves names through a hard-coded external resolver instead of the one assigned by the network. Local DNS filtering and monitoring are bypassed and the queries are visible to a third party.
  • Affected: Source 10.12.0.200, Destination 8.8.8.8, dns:53
  • Additional evidence: Packets: 307 | Time: 2026-10-21 07:10:14 UTC – 2026-10-21 07:10:14 UTC | queries=28, device_related=False
  • Recommendation: Use the DHCP-assigned resolver, or DNS over TLS/HTTPS if privacy is required.
  • Finding ID: b90cea9473b87e9a

6. Randomly-structured DNS name observed

  • Severity: LOW · Confidence: low · Category: dns_anomaly · Detector: DnsAnomalyDetector
  • 🔎 Observed artifact: Domain: mozilla.net
  • 📍 Sources:
    • Packet #673 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
    • Packet #817 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
    • Packet #818 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
  • Risk: A DNS name with a random-looking label was queried under mozilla.net. In isolation this is a weak indicator; it becomes significant only alongside many such names or other anomalies.
  • Affected: Source 10.12.0.200, Destination 8.8.8.8, dns:53, mozilla.net
  • Additional evidence: Packets: 673, 817, 818 | Time: 2026-10-21 07:10:28 UTC – 2026-10-21 07:10:28 UTC | registered_domain=mozilla.net, distinct_random_subdomains=1, examples=['content-signature-2.cdn'], device_related=False
  • Recommendation: Confirm the domain is a legitimate service; otherwise check it against threat intelligence.
  • Finding ID: bd7db6daa73bc8dc

7. Device offers a network service on port 443

  • Severity: INFO · Confidence: high · Category: insecure_protocol · Detector: InsecureProtocolDetector
  • 📍 Sources:
    • ? → 34.95.90.149 · tls:443 · Capture init-925dbe660d8b.pcapng · aggregated evidence; no single packet is available
  • Risk: The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
  • Affected: Device 34.95.90.149, Destination 34.95.90.149, tls:443 · involves device under test
  • Additional evidence: Time: — – — | port=443, protocols=['tls'], device_related=True
  • Recommendation: Confirm the service is required, authenticated and encrypted; disable it otherwise.
  • Finding ID: 016728bd857643ed

Observation Inventory

  • Capture: 3326 packets, 104.486 s, 4 internal and 23 external hosts, 82 flows, VLANs 1, 200 · extractor tshark 4.4.19

Device under test

  • 34.95.90.149 · MAC 52:54:00:3a:bf:97 · names —
  • 138 packets · sent 83.1 kB · received 6.8 kB · first seen 2026-10-21 07:10:33 UTC · last seen 2026-10-21 07:10:39 UTC
  • Services offered: 443 · ports contacted: —
  • Protocols: tls · TLS sessions: 0 · clear-text flows: 0
  • Peers (1):
    • 10.12.2.14 (10-12-2-14.local) · internal · ports 46126, 46136, 55238, 55248 · tls · to peer 83.1 kB / from peer 6.8 kB

Internal hosts (4)

  • 10.12.2.14 · MAC 6e:bd:64:d7:9a:69 · 1628 packets · offers — · 22 external endpoints
  • 10.12.2.17 · MAC 8c:4b:14:6a:1a:cc · 110 packets · offers 80 · 1 external endpoints
  • 10.12.0.200 · MAC c8:7f:54:de:c0:38 · 59 packets · offers — · 1 external endpoints
  • 10.12.0.250 · MAC 52:54:00:3a:bf:97 · 3 packets · offers 53 · 0 external endpoints

External endpoints (23)

  • 151.101.1.91 (firefox-portal-detection.com, merino.services.mozilla.com) · ports 443 · tls · encrypted · out 4.2 kB / in 100.7 kB
  • 34.95.90.149 (control.shelly.cloud) · ports 443 · tls · encrypted · out 6.8 kB / in 83.1 kB
  • 104.155.32.247 (shelly-120-eu.shelly.cloud) · ports 443, 6113 · tls · encrypted · out 32.1 kB / in 28.3 kB
  • 34.155.200.196 (integrations.loqed.com) · ports 443, 8883 · tls · encrypted · out 8.7 kB / in 32.6 kB
  • 34.54.185.247 (incoming.telemetry.mozilla.org) · ports 443 · tls · encrypted · out 25.4 kB / in 15.3 kB
  • 192.178.194.139 (android.clients.google.com, play-fe.googleapis.com) · ports 443 · quic, tls · encrypted · out 18.3 kB / in 15.0 kB
  • 3.91.171.220 (kinesis.us-east-1.amazonaws.com) · ports 443 · tls · encrypted · out 13.7 kB / in 15.6 kB
  • 35.205.173.252 (app-ratings.shelly.cloud, paypal.shelly.cloud, shelly-infra1-eu.shelly.cloud) · ports 443, 9443 · tls · encrypted · out 9.6 kB / in 18.3 kB
  • 34.62.47.252 (changelog-backend.shelly.cloud) · ports 443 · tls · encrypted · out 5.8 kB / in 21.7 kB
  • 34.79.5.199 (shelly-101-eu.shelly.cloud) · ports 31234 · tls · encrypted · out 7.9 kB / in 19.4 kB
  • 51.124.96.69 (app-api.cmap.abus.com) · ports 443 · tls · encrypted · out 11.5 kB / in 11.9 kB
  • 34.117.64.196 (assets.mozilla.net) · ports 443 · tls · encrypted · out 5.6 kB / in 16.2 kB
  • 100.50.70.74 (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · ports 443 · tls · encrypted · out 4.4 kB / in 11.0 kB
  • 34.149.226.178 (content-signature-2.cdn.mozilla.net) · ports 443 · tls · encrypted · out 2.9 kB / in 11.3 kB
  • 35.241.201.25 (repo.shelly.cloud) · ports 443 · tls · encrypted · out 2.6 kB / in 9.7 kB
  • 192.178.194.95 (fonts.googleapis.com) · ports 443 · quic, tls · encrypted · out 4.4 kB / in 7.2 kB
  • 142.251.27.94 (fonts.gstatic.com) · ports 443 · quic, tls · encrypted · out 4.3 kB / in 7.0 kB
  • 142.251.150.120 (connectivitycheck.gstatic.com) · ports 443 · tls · encrypted · out 3.0 kB / in 8.1 kB
  • 172.217.119.4 (play.googleapis.com, playstoregatewayadapter-pa.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com) · ports 443 · tls · encrypted · out 4.1 kB / in 6.1 kB
  • 8.8.8.8 · ports 53 · dns · clear-text or unknown · out 2.5 kB / in 5.1 kB
  • 151.101.65.91 (firefox-portal-detection.com, merino.services.mozilla.com) · ports 80 · http · clear-text or unknown · out 661 B / in 727 B
  • 192.178.194.102 (android.clients.google.com, clients3.google.com, play-fe.googleapis.com) · ports 80 · http · clear-text or unknown · out 543 B / in 345 B
  • 51.102.84.134 · ports 443 · undecoded · clear-text or unknown · out 70 B / in 0 B

Services observed (29)

  • 34.95.90.149:443 https (tcp) ← device · encrypted · 2 flows from 1 clients
  • 10.12.0.200:53 dns (udp) · unknown · 1 flows from 1 clients
  • 10.12.0.250:53 dns (udp) · unknown · 1 flows from 1 clients
  • 10.12.2.17:80 http (tcp) · clear-text · 1 flows from 1 clients
  • 100.50.70.74:443 https (tcp) · encrypted · 2 flows from 1 clients
  • 104.155.32.247:443 https (tcp) · encrypted · 4 flows from 1 clients
  • 104.155.32.247:6113 tls/6113 (tcp) · encrypted · 2 flows from 1 clients
  • 142.251.150.120:443 https (tcp) · encrypted · 2 flows from 1 clients
  • 142.251.27.94:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 151.101.1.91:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 151.101.65.91:80 http (tcp) · clear-text · 1 flows from 1 clients
  • 172.217.119.4:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 192.178.194.102:80 http (tcp) · clear-text · 1 flows from 1 clients
  • 192.178.194.139:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 192.178.194.139:443 quic (udp) · encrypted · 2 flows from 1 clients
  • 192.178.194.95:443 quic (udp) · encrypted · 1 flows from 1 clients
  • 3.91.171.220:443 https (tcp) · encrypted · 2 flows from 1 clients
  • 34.117.64.196:443 https (tcp) · encrypted · 2 flows from 1 clients
  • 34.149.226.178:443 https (tcp) · encrypted · 2 flows from 1 clients
  • 34.155.200.196:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 34.155.200.196:8883 mqtts (tcp) · encrypted · 1 flows from 1 clients
  • 34.54.185.247:443 https (tcp) · encrypted · 2 flows from 1 clients
  • 34.62.47.252:443 https (tcp) · encrypted · 4 flows from 1 clients
  • 34.79.5.199:31234 tls/31234 (tcp) · encrypted · 2 flows from 1 clients
  • 35.205.173.252:443 https (tcp) · encrypted · 2 flows from 1 clients
  • 35.205.173.252:9443 tls/9443 (tcp) · encrypted · 1 flows from 1 clients
  • 35.241.201.25:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 51.124.96.69:443 https (tcp) · encrypted · 1 flows from 1 clients
  • 8.8.8.8:53 dns (udp) · unknown · 28 flows from 1 clients

Protocols (packets)

  • ip 1784, arp 1542, tcp 1414, tls 588, udp 370, mdns 222, quic 89, dns 59, http 6, icmp 1
  • ICMP: unreachable 1

TLS posture (35 handshakes)

  • Versions: TLS 1.3 ×23, TLS 1.2 ×12
  • Cipher suites: TLS_AES_128_GCM_SHA256 ×14, TLS_AES_256_GCM_SHA384 ×9, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ×2, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ×8, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ×2
  • 10.12.2.14 → 34.95.90.149:443 (control.shelly.cloud) ← device · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 34.95.90.149:443 (control.shelly.cloud) ← device · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 100.50.70.74:443 (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 100.50.70.74:443 (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 104.155.32.247:443 (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 104.155.32.247:443 (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 104.155.32.247:443 (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 104.155.32.247:6113 (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
  • 10.12.2.14 → 142.251.150.120:443 (connectivitycheck.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 142.251.150.120:443 (connectivitycheck.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 142.251.27.94:443 (fonts.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 151.101.1.91:443 (merino.services.mozilla.com) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert merino.services.mozilla.com by YR1, expires 2026-12-25 12:57:43 UTC
  • 10.12.2.14 → 172.217.119.4:443 (remoteprovisioning.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
  • 10.12.2.14 → 192.178.194.139:443 (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
  • 10.12.2.14 → 192.178.194.139:443 (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
  • 10.12.2.14 → 192.178.194.139:443 (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
  • 10.12.2.14 → 192.178.194.95:443 (fonts.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
  • 10.12.2.14 → 3.91.171.220:443 (kinesis.us-east-1.amazonaws.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 3.91.171.220:443 (kinesis.us-east-1.amazonaws.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 34.117.64.196:443 (assets.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert cdn.website.assets-mozilla-net.prod.webservices.mozgcp.net by YR2, expires 2026-11-21 22:55:06 UTC
  • 10.12.2.14 → 34.117.64.196:443 (assets.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert cdn.website.assets-mozilla-net.prod.webservices.mozgcp.net by YR2, expires 2026-11-21 22:55:06 UTC
  • 10.12.2.14 → 34.149.226.178:443 (content-signature-2.cdn.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert content-signature-2.cdn.mozilla.net by YR2, expires 2026-12-23 09:28:57 UTC
  • 10.12.2.14 → 34.149.226.178:443 (content-signature-2.cdn.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert content-signature-2.cdn.mozilla.net by YR2, expires 2026-12-23 09:28:57 UTC
  • 10.12.2.14 → 34.155.200.196:443 (integrations.loqed.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
  • 10.12.2.14 → 34.54.185.247:443 (incoming.telemetry.mozilla.org) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert incoming.telemetry.mozilla.org by DigiCert Global G2 TLS RSA SHA256 2020 CA1, expires 2026-11-19 23:59:59 UTC
  • 10.12.2.14 → 34.54.185.247:443 (incoming.telemetry.mozilla.org) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
  • 10.12.2.14 → 34.62.47.252:443 (changelog-backend.shelly.cloud) · TLS 1.2 · TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.3 · cert changelog-backend.shelly.cloud by YE1, expires 2026-12-20 09:03:22 UTC
  • 10.12.2.14 → 34.62.47.252:443 (changelog-backend.shelly.cloud) · TLS 1.2 · TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.3 · cert changelog-backend.shelly.cloud by YE1, expires 2026-12-20 09:03:22 UTC
  • 10.12.2.14 → 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
  • 10.12.2.14 → 34.79.5.199:31234 (shelly-101-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3

DNS (176 queries, 30 responses, 25 names)

  • Response codes: NOERROR 29, NXDOMAIN 1 · resolvers: 8.8.8.8 (28), 10.12.0.250 (1), 10.12.0.200 (1)
  • _http._tcp.local · 60× · PTR · no answer seen
  • _shelly._tcp.local · 60× · PTR · no answer seen
  • 10-12-2-14.local · 27× · ANY · no answer seen
  • firefox-portal-detection.com · 3× · A, HTTPS · 151.101.1.91, 151.101.129.91, 151.101.193.91, 151.101.65.91
  • incoming.telemetry.mozilla.org · 3× · A, HTTPS · 34.54.185.247
  • assets.mozilla.net · 2× · A, HTTPS · 34.117.64.196
  • fonts.googleapis.com · 2× · A, HTTPS · 192.178.194.95
  • merino.services.mozilla.com · 2× · A, HTTPS · 151.101.1.91, 151.101.129.91, 151.101.193.91, 151.101.65.91
  • _31234._https.shelly-101-eu.shelly.cloud · 1× · HTTPS · no answer seen
  • android.clients.google.com · 1× · A · 142.251.27.102, 142.251.27.139, 172.217.168.142, 192.178.194.102, 192.178.194.138, 192.178.194.139
  • cloudflare-dns.com · 1× · HTTPS · no answer seen
  • content-signature-2.cdn.mozilla.net · 1× · HTTPS · no answer seen
  • d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com · 1× · A · 100.31.167.60, 100.50.70.74, 13.216.221.160, 52.45.179.236
  • example.org · 1× · A · 104.20.26.136, 172.66.157.237
  • fonts.gstatic.com · 1× · HTTPS · no answer seen
  • i.ytimg.com · 1× · A · 142.251.145.6, 142.251.147.6, 142.251.148.6, 142.251.149.6, 192.178.40.6, 192.178.41.6
  • integrations.loqed.com · 1× · HTTPS · no answer seen
  • kinesis.us-east-1.amazonaws.com · 1× · A · 3.91.171.220
  • play-fe.googleapis.com · 1× · A · 192.178.194.100, 192.178.194.101, 192.178.194.102, 192.178.194.113, 192.178.194.138, 192.178.194.139
  • play-lh.googleusercontent.com · 1× · A · 192.178.194.119
  • play.googleapis.com · 1× · A · 172.217.113.4, 172.217.114.4, 172.217.115.4, 172.217.116.4, 172.217.118.4, 172.217.119.4
  • playstoregatewayadapter-pa.googleapis.com · 1× · A · 172.217.112.4, 172.217.114.4, 172.217.116.4, 172.217.117.4, 172.217.118.4, 172.217.119.4
  • prod-lt-playstoregatewayadapter-pa.googleapis.com · 1× · A · 172.217.112.4, 172.217.113.4, 172.217.114.4, 172.217.115.4, 172.217.117.4, 172.217.118.4
  • remoteprovisioning.googleapis.com · 1× · A · 172.217.112.4, 172.217.113.4, 172.217.114.4, 172.217.117.4, 172.217.118.4, 172.217.119.4
  • shelly-101-eu.shelly.cloud · 1× · A · 34.79.5.199

HTTP (6 requests)

  • 10.12.2.14 · 3 requests · · /success.txt?ipv4, /generate_204, /shelly
  • firefox-portal-detection.com · 1 requests · GET · /success.txt?ipv4
  • clients3.google.com · 1 requests · GET · /generate_204
  • 10.12.2.17 · 1 requests · GET · /shelly

Clear-text protocols and service events

  • http: 3 flows, 1.2 kB · 10.12.2.14 -> 10.12.2.17:80; 10.12.2.14 -> 151.101.65.91:80; 10.12.2.14 -> 192.178.194.102:80

Coverage

  • Complete extraction · 82 flows, 40 encrypted, 0 with undecoded payload · 18 clear-text payloads scanned
  • 23 TLS 1.3 sessions: server certificates are encrypted and could not be inspected.

Cloud URLs and Endpoints (38)

  • 10-12-2-14.local — Ports: —; TLS: N/A; Cipher: N/A
  • 10.12.2.17 — Ports: —; TLS: N/A; Cipher: N/A
  • 51.102.84.134 — Ports: 443, 8000; TLS: N/A; Cipher: N/A
  • 8.8.8.8 — Ports: 53, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • _31234._https.shelly-101-eu.shelly.cloud — Ports: —; TLS: N/A; Cipher: N/A
  • _http._tcp.local — Ports: —; TLS: N/A; Cipher: N/A
  • _shelly._tcp.local — Ports: —; TLS: N/A; Cipher: N/A
  • android.clients.google.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • app-api.cmap.abus.com — Ports: 80, 443; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-SHA384
  • app-ratings.shelly.cloud — Ports: 22, 80, 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384
  • assets.mozilla.net — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • changelog-backend.shelly.cloud — Ports: 22, 80, 443; TLS: TLSv1.2; Cipher: ECDHE-ECDSA-AES256-GCM-SHA384
  • clients3.google.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • cloudflare-dns.com — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • connectivitycheck.gstatic.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • content-signature-2.cdn.mozilla.net — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • control.shelly.cloud — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
  • example.org — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • firefox-portal-detection.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
  • fonts.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • fonts.gstatic.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • i.ytimg.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • incoming.telemetry.mozilla.org — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • integrations.loqed.com — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
  • kinesis.us-east-1.amazonaws.com — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
  • merino.services.mozilla.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
  • paypal.shelly.cloud — Ports: 22, 80, 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384
  • play-fe.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • play-lh.googleusercontent.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • play.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • playstoregatewayadapter-pa.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • prod-lt-playstoregatewayadapter-pa.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • remoteprovisioning.googleapis.com — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • repo.shelly.cloud — Ports: 22, 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • shelly-101-eu.shelly.cloud — Ports: 22, 80, 443, 31234; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • shelly-120-eu.shelly.cloud — Ports: 22, 80, 443, 6113; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
  • shelly-infra1-eu.shelly.cloud — Ports: 22, 80, 443, 8000, 9443; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384

Generated by IoT PreTester 4.6 · Detectors: PlaintextCredentialDetector, PasswordHashDetector, TokenSecretDetector, MalwareBeaconingDetector, ExfiltrationDetector, MitmDetector, InsecureProtocolDetector, TlsWeaknessDetector, DnsAnomalyDetector, BruteforceScanFileTransferDetector

Reference in New Issue View Git Blame Copy Permalink