305 lines
25 KiB
Markdown
305 lines
25 KiB
Markdown
# IoT PreTester 4.6 — Network Capture Security Analysis
|
||
|
||
- **Capture:** `/app/files/uploads/init-925dbe660d8b.pcapng`
|
||
- **Packets:** 3326 · **Duration:** 104.486 s · **Findings:** 7
|
||
- **Device under test:** `34.95.90.149` (MAC 52:54:00:3a:bf:97) · device-related findings: 1, other hosts: 6
|
||
|
||
## Summary
|
||
|
||
| Severity | Count |
|
||
| ----------- | ------ |
|
||
| CRITICAL | 0 |
|
||
| HIGH | 0 |
|
||
| MEDIUM | 4 |
|
||
| LOW | 2 |
|
||
| INFO | 1 |
|
||
|
||
## Findings
|
||
|
||
### 1. Clear-text protocol: HTTP on 151.101.65.91:80
|
||
|
||
- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
|
||
- **📍 Sources:**
|
||
- Packet #716 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #744 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #759 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #762 · Stream 15 · 10.12.2.14 → 151.101.65.91 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- **Risk:** HTTP content is unencrypted and can be read or modified on the path.
|
||
- **Affected:** Source 10.12.2.14, Destination 151.101.65.91, http:80
|
||
- **Additional evidence:** Packets: 716, 744, 759, 762 | Streams: 15 | Time: 2026-10-21 07:10:28 UTC – 2026-10-21 07:10:28 UTC | port=80, packets=10, payload_bytes=672, clients=['10.12.2.14'], client_count=1, external_server=True
|
||
- **Recommendation:** Require HTTPS for all device and cloud communication.
|
||
- **Finding ID:** `3b872ab0d3a1a494`
|
||
|
||
### 2. Clear-text protocol: HTTP on 192.178.194.102:80
|
||
|
||
- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
|
||
- **📍 Sources:**
|
||
- Packet #1307 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #1308 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #1309 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #1310 · Stream 30 · 10.12.2.14 → 192.178.194.102 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- **Risk:** HTTP content is unencrypted and can be read or modified on the path.
|
||
- **Affected:** Source 10.12.2.14, Destination 192.178.194.102, http:80
|
||
- **Additional evidence:** Packets: 1307, 1308, 1309, 1310 | Streams: 30 | Time: 2026-10-21 07:10:36 UTC – 2026-10-21 07:10:36 UTC | port=80, packets=7, payload_bytes=312, clients=['10.12.2.14'], client_count=1, external_server=True
|
||
- **Recommendation:** Require HTTPS for all device and cloud communication.
|
||
- **Finding ID:** `401b185216f10382`
|
||
|
||
### 3. Clear-text protocol: HTTP on 10.12.2.17:80
|
||
|
||
- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
|
||
- **📍 Sources:**
|
||
- Packet #1632 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #1659 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #1711 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #1712 · Stream 39 · 10.12.2.14 → 10.12.2.17 · http:80 · Capture init-925dbe660d8b.pcapng
|
||
- **Risk:** HTTP content is unencrypted and can be read or modified on the path.
|
||
- **Affected:** Source 10.12.2.14, Destination 10.12.2.17, http:80
|
||
- **Additional evidence:** Packets: 1632, 1659, 1711, 1712 | Streams: 39 | Time: 2026-10-21 07:10:38 UTC – 2026-10-21 07:10:39 UTC | port=80, packets=13, payload_bytes=221, clients=['10.12.2.14'], client_count=1, external_server=False
|
||
- **Recommendation:** Require HTTPS for all device and cloud communication.
|
||
- **Finding ID:** `a80245540240803f`
|
||
|
||
### 4. Overlong DNS label suggests tunneling
|
||
|
||
- **Severity:** MEDIUM · **Confidence:** low · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
|
||
- **🔎 Observed artifact:** `DNS query: d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com`
|
||
- **📍 Sources:**
|
||
- Packet #307 · 2026-10-21 07:10:14 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
|
||
- **Risk:** A DNS label of 63 characters was observed under a2z.com. Overlong labels are used to encode data in DNS tunnels.
|
||
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53, a2z.com
|
||
- **Additional evidence:** Packets: 307 | Time: 2026-10-21 07:10:14 UTC – 2026-10-21 07:10:14 UTC | registered_domain=a2z.com, query_name=d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com, label_length=63, device_related=False
|
||
- **Recommendation:** Review the destination domain and enable tunneling detection.
|
||
- **Finding ID:** `2bde55c6733c1b91`
|
||
|
||
### 5. DNS sent directly to an external resolver (8.8.8.8)
|
||
|
||
- **Severity:** LOW · **Confidence:** high · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
|
||
- **📍 Sources:**
|
||
- Packet #307 · 2026-10-21 07:10:14 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
|
||
- **Risk:** The host resolves names through a hard-coded external resolver instead of the one assigned by the network. Local DNS filtering and monitoring are bypassed and the queries are visible to a third party.
|
||
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53
|
||
- **Additional evidence:** Packets: 307 | Time: 2026-10-21 07:10:14 UTC – 2026-10-21 07:10:14 UTC | queries=28, device_related=False
|
||
- **Recommendation:** Use the DHCP-assigned resolver, or DNS over TLS/HTTPS if privacy is required.
|
||
- **Finding ID:** `b90cea9473b87e9a`
|
||
|
||
### 6. Randomly-structured DNS name observed
|
||
|
||
- **Severity:** LOW · **Confidence:** low · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
|
||
- **🔎 Observed artifact:** `Domain: mozilla.net`
|
||
- **📍 Sources:**
|
||
- Packet #673 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #817 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
|
||
- Packet #818 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture init-925dbe660d8b.pcapng
|
||
- **Risk:** A DNS name with a random-looking label was queried under mozilla.net. In isolation this is a weak indicator; it becomes significant only alongside many such names or other anomalies.
|
||
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53, mozilla.net
|
||
- **Additional evidence:** Packets: 673, 817, 818 | Time: 2026-10-21 07:10:28 UTC – 2026-10-21 07:10:28 UTC | registered_domain=mozilla.net, distinct_random_subdomains=1, examples=['content-signature-2.cdn'], device_related=False
|
||
- **Recommendation:** Confirm the domain is a legitimate service; otherwise check it against threat intelligence.
|
||
- **Finding ID:** `bd7db6daa73bc8dc`
|
||
|
||
### 7. Device offers a network service on port 443
|
||
|
||
- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
|
||
- **📍 Sources:**
|
||
- ? → 34.95.90.149 · tls:443 · Capture init-925dbe660d8b.pcapng · aggregated evidence; no single packet is available
|
||
- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
|
||
- **Affected:** Device 34.95.90.149, Destination 34.95.90.149, tls:443 · **involves device under test**
|
||
- **Additional evidence:** Time: — – — | port=443, protocols=['tls'], device_related=True
|
||
- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise.
|
||
- **Finding ID:** `016728bd857643ed`
|
||
|
||
|
||
## Observation Inventory
|
||
|
||
- Capture: 3326 packets, 104.486 s, 4 internal and 23 external hosts, 82 flows, VLANs 1, 200 · extractor tshark 4.4.19
|
||
|
||
### Device under test
|
||
- `34.95.90.149` · MAC 52:54:00:3a:bf:97 · names —
|
||
- 138 packets · sent 83.1 kB · received 6.8 kB · first seen 2026-10-21 07:10:33 UTC · last seen 2026-10-21 07:10:39 UTC
|
||
- Services offered: 443 · ports contacted: —
|
||
- Protocols: tls · TLS sessions: 0 · clear-text flows: 0
|
||
- Peers (1):
|
||
- `10.12.2.14` (10-12-2-14.local) · internal · ports 46126, 46136, 55238, 55248 · tls · to peer 83.1 kB / from peer 6.8 kB
|
||
|
||
### Internal hosts (4)
|
||
- `10.12.2.14` · MAC 6e:bd:64:d7:9a:69 · 1628 packets · offers — · 22 external endpoints
|
||
- `10.12.2.17` · MAC 8c:4b:14:6a:1a:cc · 110 packets · offers 80 · 1 external endpoints
|
||
- `10.12.0.200` · MAC c8:7f:54:de:c0:38 · 59 packets · offers — · 1 external endpoints
|
||
- `10.12.0.250` · MAC 52:54:00:3a:bf:97 · 3 packets · offers 53 · 0 external endpoints
|
||
|
||
### External endpoints (23)
|
||
- `151.101.1.91` (firefox-portal-detection.com, merino.services.mozilla.com) · ports 443 · tls · encrypted · out 4.2 kB / in 100.7 kB
|
||
- `34.95.90.149` (control.shelly.cloud) · ports 443 · tls · encrypted · out 6.8 kB / in 83.1 kB
|
||
- `104.155.32.247` (shelly-120-eu.shelly.cloud) · ports 443, 6113 · tls · encrypted · out 32.1 kB / in 28.3 kB
|
||
- `34.155.200.196` (integrations.loqed.com) · ports 443, 8883 · tls · encrypted · out 8.7 kB / in 32.6 kB
|
||
- `34.54.185.247` (incoming.telemetry.mozilla.org) · ports 443 · tls · encrypted · out 25.4 kB / in 15.3 kB
|
||
- `192.178.194.139` (android.clients.google.com, play-fe.googleapis.com) · ports 443 · quic, tls · encrypted · out 18.3 kB / in 15.0 kB
|
||
- `3.91.171.220` (kinesis.us-east-1.amazonaws.com) · ports 443 · tls · encrypted · out 13.7 kB / in 15.6 kB
|
||
- `35.205.173.252` (app-ratings.shelly.cloud, paypal.shelly.cloud, shelly-infra1-eu.shelly.cloud) · ports 443, 9443 · tls · encrypted · out 9.6 kB / in 18.3 kB
|
||
- `34.62.47.252` (changelog-backend.shelly.cloud) · ports 443 · tls · encrypted · out 5.8 kB / in 21.7 kB
|
||
- `34.79.5.199` (shelly-101-eu.shelly.cloud) · ports 31234 · tls · encrypted · out 7.9 kB / in 19.4 kB
|
||
- `51.124.96.69` (app-api.cmap.abus.com) · ports 443 · tls · encrypted · out 11.5 kB / in 11.9 kB
|
||
- `34.117.64.196` (assets.mozilla.net) · ports 443 · tls · encrypted · out 5.6 kB / in 16.2 kB
|
||
- `100.50.70.74` (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · ports 443 · tls · encrypted · out 4.4 kB / in 11.0 kB
|
||
- `34.149.226.178` (content-signature-2.cdn.mozilla.net) · ports 443 · tls · encrypted · out 2.9 kB / in 11.3 kB
|
||
- `35.241.201.25` (repo.shelly.cloud) · ports 443 · tls · encrypted · out 2.6 kB / in 9.7 kB
|
||
- `192.178.194.95` (fonts.googleapis.com) · ports 443 · quic, tls · encrypted · out 4.4 kB / in 7.2 kB
|
||
- `142.251.27.94` (fonts.gstatic.com) · ports 443 · quic, tls · encrypted · out 4.3 kB / in 7.0 kB
|
||
- `142.251.150.120` (connectivitycheck.gstatic.com) · ports 443 · tls · encrypted · out 3.0 kB / in 8.1 kB
|
||
- `172.217.119.4` (play.googleapis.com, playstoregatewayadapter-pa.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com) · ports 443 · tls · encrypted · out 4.1 kB / in 6.1 kB
|
||
- `8.8.8.8` · ports 53 · dns · clear-text or unknown · out 2.5 kB / in 5.1 kB
|
||
- `151.101.65.91` (firefox-portal-detection.com, merino.services.mozilla.com) · ports 80 · http · clear-text or unknown · out 661 B / in 727 B
|
||
- `192.178.194.102` (android.clients.google.com, clients3.google.com, play-fe.googleapis.com) · ports 80 · http · clear-text or unknown · out 543 B / in 345 B
|
||
- `51.102.84.134` · ports 443 · undecoded · clear-text or unknown · out 70 B / in 0 B
|
||
|
||
### Services observed (29)
|
||
- `34.95.90.149:443` https (tcp) ← device · encrypted · 2 flows from 1 clients
|
||
- `10.12.0.200:53` dns (udp) · unknown · 1 flows from 1 clients
|
||
- `10.12.0.250:53` dns (udp) · unknown · 1 flows from 1 clients
|
||
- `10.12.2.17:80` http (tcp) · clear-text · 1 flows from 1 clients
|
||
- `100.50.70.74:443` https (tcp) · encrypted · 2 flows from 1 clients
|
||
- `104.155.32.247:443` https (tcp) · encrypted · 4 flows from 1 clients
|
||
- `104.155.32.247:6113` tls/6113 (tcp) · encrypted · 2 flows from 1 clients
|
||
- `142.251.150.120:443` https (tcp) · encrypted · 2 flows from 1 clients
|
||
- `142.251.27.94:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `151.101.1.91:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `151.101.65.91:80` http (tcp) · clear-text · 1 flows from 1 clients
|
||
- `172.217.119.4:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `192.178.194.102:80` http (tcp) · clear-text · 1 flows from 1 clients
|
||
- `192.178.194.139:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `192.178.194.139:443` quic (udp) · encrypted · 2 flows from 1 clients
|
||
- `192.178.194.95:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `3.91.171.220:443` https (tcp) · encrypted · 2 flows from 1 clients
|
||
- `34.117.64.196:443` https (tcp) · encrypted · 2 flows from 1 clients
|
||
- `34.149.226.178:443` https (tcp) · encrypted · 2 flows from 1 clients
|
||
- `34.155.200.196:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `34.155.200.196:8883` mqtts (tcp) · encrypted · 1 flows from 1 clients
|
||
- `34.54.185.247:443` https (tcp) · encrypted · 2 flows from 1 clients
|
||
- `34.62.47.252:443` https (tcp) · encrypted · 4 flows from 1 clients
|
||
- `34.79.5.199:31234` tls/31234 (tcp) · encrypted · 2 flows from 1 clients
|
||
- `35.205.173.252:443` https (tcp) · encrypted · 2 flows from 1 clients
|
||
- `35.205.173.252:9443` tls/9443 (tcp) · encrypted · 1 flows from 1 clients
|
||
- `35.241.201.25:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `51.124.96.69:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `8.8.8.8:53` dns (udp) · unknown · 28 flows from 1 clients
|
||
|
||
### Protocols (packets)
|
||
- ip 1784, arp 1542, tcp 1414, tls 588, udp 370, mdns 222, quic 89, dns 59, http 6, icmp 1
|
||
- ICMP: unreachable 1
|
||
|
||
### TLS posture (35 handshakes)
|
||
- Versions: TLS 1.3 ×23, TLS 1.2 ×12
|
||
- Cipher suites: TLS_AES_128_GCM_SHA256 ×14, TLS_AES_256_GCM_SHA384 ×9, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ×2, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ×8, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ×2
|
||
- 10.12.2.14 → `34.95.90.149:443` (control.shelly.cloud) ← device · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `34.95.90.149:443` (control.shelly.cloud) ← device · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `100.50.70.74:443` (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `100.50.70.74:443` (d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `104.155.32.247:443` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `104.155.32.247:443` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `104.155.32.247:443` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `104.155.32.247:6113` (shelly-120-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
|
||
- 10.12.2.14 → `142.251.150.120:443` (connectivitycheck.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `142.251.150.120:443` (connectivitycheck.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `142.251.27.94:443` (fonts.gstatic.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `151.101.1.91:443` (merino.services.mozilla.com) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert merino.services.mozilla.com by YR1, expires 2026-12-25 12:57:43 UTC
|
||
- 10.12.2.14 → `172.217.119.4:443` (remoteprovisioning.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
|
||
- 10.12.2.14 → `192.178.194.139:443` (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
|
||
- 10.12.2.14 → `192.178.194.139:443` (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
|
||
- 10.12.2.14 → `192.178.194.139:443` (play-fe.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
|
||
- 10.12.2.14 → `192.178.194.95:443` (fonts.googleapis.com) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
|
||
- 10.12.2.14 → `3.91.171.220:443` (kinesis.us-east-1.amazonaws.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `3.91.171.220:443` (kinesis.us-east-1.amazonaws.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `34.117.64.196:443` (assets.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert cdn.website.assets-mozilla-net.prod.webservices.mozgcp.net by YR2, expires 2026-11-21 22:55:06 UTC
|
||
- 10.12.2.14 → `34.117.64.196:443` (assets.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert cdn.website.assets-mozilla-net.prod.webservices.mozgcp.net by YR2, expires 2026-11-21 22:55:06 UTC
|
||
- 10.12.2.14 → `34.149.226.178:443` (content-signature-2.cdn.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert content-signature-2.cdn.mozilla.net by YR2, expires 2026-12-23 09:28:57 UTC
|
||
- 10.12.2.14 → `34.149.226.178:443` (content-signature-2.cdn.mozilla.net) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert content-signature-2.cdn.mozilla.net by YR2, expires 2026-12-23 09:28:57 UTC
|
||
- 10.12.2.14 → `34.155.200.196:443` (integrations.loqed.com) · TLS 1.3 · TLS_AES_128_GCM_SHA256 · client max TLS 1.3
|
||
- 10.12.2.14 → `34.54.185.247:443` (incoming.telemetry.mozilla.org) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert incoming.telemetry.mozilla.org by DigiCert Global G2 TLS RSA SHA256 2020 CA1, expires 2026-11-19 23:59:59 UTC
|
||
- 10.12.2.14 → `34.54.185.247:443` (incoming.telemetry.mozilla.org) · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
|
||
- 10.12.2.14 → `34.62.47.252:443` (changelog-backend.shelly.cloud) · TLS 1.2 · TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.3 · cert changelog-backend.shelly.cloud by YE1, expires 2026-12-20 09:03:22 UTC
|
||
- 10.12.2.14 → `34.62.47.252:443` (changelog-backend.shelly.cloud) · TLS 1.2 · TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.3 · cert changelog-backend.shelly.cloud by YE1, expires 2026-12-20 09:03:22 UTC
|
||
- 10.12.2.14 → `34.79.5.199:31234` (shelly-101-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
|
||
- 10.12.2.14 → `34.79.5.199:31234` (shelly-101-eu.shelly.cloud) · TLS 1.3 · TLS_AES_256_GCM_SHA384 · client max TLS 1.3
|
||
|
||
### DNS (176 queries, 30 responses, 25 names)
|
||
- Response codes: NOERROR 29, NXDOMAIN 1 · resolvers: 8.8.8.8 (28), 10.12.0.250 (1), 10.12.0.200 (1)
|
||
- `_http._tcp.local` · 60× · PTR · no answer seen
|
||
- `_shelly._tcp.local` · 60× · PTR · no answer seen
|
||
- `10-12-2-14.local` · 27× · ANY · no answer seen
|
||
- `firefox-portal-detection.com` · 3× · A, HTTPS · 151.101.1.91, 151.101.129.91, 151.101.193.91, 151.101.65.91
|
||
- `incoming.telemetry.mozilla.org` · 3× · A, HTTPS · 34.54.185.247
|
||
- `assets.mozilla.net` · 2× · A, HTTPS · 34.117.64.196
|
||
- `fonts.googleapis.com` · 2× · A, HTTPS · 192.178.194.95
|
||
- `merino.services.mozilla.com` · 2× · A, HTTPS · 151.101.1.91, 151.101.129.91, 151.101.193.91, 151.101.65.91
|
||
- `_31234._https.shelly-101-eu.shelly.cloud` · 1× · HTTPS · no answer seen
|
||
- `android.clients.google.com` · 1× · A · 142.251.27.102, 142.251.27.139, 172.217.168.142, 192.178.194.102, 192.178.194.138, 192.178.194.139
|
||
- `cloudflare-dns.com` · 1× · HTTPS · no answer seen
|
||
- `content-signature-2.cdn.mozilla.net` · 1× · HTTPS · no answer seen
|
||
- `d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com` · 1× · A · 100.31.167.60, 100.50.70.74, 13.216.221.160, 52.45.179.236
|
||
- `example.org` · 1× · A · 104.20.26.136, 172.66.157.237
|
||
- `fonts.gstatic.com` · 1× · HTTPS · no answer seen
|
||
- `i.ytimg.com` · 1× · A · 142.251.145.6, 142.251.147.6, 142.251.148.6, 142.251.149.6, 192.178.40.6, 192.178.41.6
|
||
- `integrations.loqed.com` · 1× · HTTPS · no answer seen
|
||
- `kinesis.us-east-1.amazonaws.com` · 1× · A · 3.91.171.220
|
||
- `play-fe.googleapis.com` · 1× · A · 192.178.194.100, 192.178.194.101, 192.178.194.102, 192.178.194.113, 192.178.194.138, 192.178.194.139
|
||
- `play-lh.googleusercontent.com` · 1× · A · 192.178.194.119
|
||
- `play.googleapis.com` · 1× · A · 172.217.113.4, 172.217.114.4, 172.217.115.4, 172.217.116.4, 172.217.118.4, 172.217.119.4
|
||
- `playstoregatewayadapter-pa.googleapis.com` · 1× · A · 172.217.112.4, 172.217.114.4, 172.217.116.4, 172.217.117.4, 172.217.118.4, 172.217.119.4
|
||
- `prod-lt-playstoregatewayadapter-pa.googleapis.com` · 1× · A · 172.217.112.4, 172.217.113.4, 172.217.114.4, 172.217.115.4, 172.217.117.4, 172.217.118.4
|
||
- `remoteprovisioning.googleapis.com` · 1× · A · 172.217.112.4, 172.217.113.4, 172.217.114.4, 172.217.117.4, 172.217.118.4, 172.217.119.4
|
||
- `shelly-101-eu.shelly.cloud` · 1× · A · 34.79.5.199
|
||
|
||
### HTTP (6 requests)
|
||
- `10.12.2.14` · 3 requests · · /success.txt?ipv4, /generate_204, /shelly
|
||
- `firefox-portal-detection.com` · 1 requests · GET · /success.txt?ipv4
|
||
- `clients3.google.com` · 1 requests · GET · /generate_204
|
||
- `10.12.2.17` · 1 requests · GET · /shelly
|
||
|
||
### Clear-text protocols and service events
|
||
- http: 3 flows, 1.2 kB · 10.12.2.14 -> 10.12.2.17:80; 10.12.2.14 -> 151.101.65.91:80; 10.12.2.14 -> 192.178.194.102:80
|
||
|
||
### Coverage
|
||
- Complete extraction · 82 flows, 40 encrypted, 0 with undecoded payload · 18 clear-text payloads scanned
|
||
- 23 TLS 1.3 sessions: server certificates are encrypted and could not be inspected.
|
||
|
||
## Cloud URLs and Endpoints (38)
|
||
|
||
- `10-12-2-14.local` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `10.12.2.17` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `51.102.84.134` — Ports: 443, 8000; TLS: N/A; Cipher: N/A
|
||
- `8.8.8.8` — Ports: 53, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `_31234._https.shelly-101-eu.shelly.cloud` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `_http._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `_shelly._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `android.clients.google.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `app-api.cmap.abus.com` — Ports: 80, 443; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-SHA384
|
||
- `app-ratings.shelly.cloud` — Ports: 22, 80, 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384
|
||
- `assets.mozilla.net` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `changelog-backend.shelly.cloud` — Ports: 22, 80, 443; TLS: TLSv1.2; Cipher: ECDHE-ECDSA-AES256-GCM-SHA384
|
||
- `clients3.google.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `cloudflare-dns.com` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `connectivitycheck.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `content-signature-2.cdn.mozilla.net` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `control.shelly.cloud` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `d7ae3d206ce5366b0f0105dc74e8b013274baf9c15fd9588c12a576fa3ac95c.us-east-1.prod.service.minerva.devices.a2z.com` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
|
||
- `example.org` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `firefox-portal-detection.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
|
||
- `fonts.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `fonts.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `i.ytimg.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `incoming.telemetry.mozilla.org` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `integrations.loqed.com` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
|
||
- `kinesis.us-east-1.amazonaws.com` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
|
||
- `merino.services.mozilla.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
|
||
- `paypal.shelly.cloud` — Ports: 22, 80, 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384
|
||
- `play-fe.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `play-lh.googleusercontent.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `play.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `playstoregatewayadapter-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `prod-lt-playstoregatewayadapter-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `remoteprovisioning.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `repo.shelly.cloud` — Ports: 22, 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `shelly-101-eu.shelly.cloud` — Ports: 22, 80, 443, 31234; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `shelly-120-eu.shelly.cloud` — Ports: 22, 80, 443, 6113; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `shelly-infra1-eu.shelly.cloud` — Ports: 22, 80, 443, 8000, 9443; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES256-GCM-SHA384
|
||
|
||
---
|
||
_Generated by IoT PreTester 4.6 · Detectors: PlaintextCredentialDetector, PasswordHashDetector, TokenSecretDetector, MalwareBeaconingDetector, ExfiltrationDetector, MitmDetector, InsecureProtocolDetector, TlsWeaknessDetector, DnsAnomalyDetector, BruteforceScanFileTransferDetector_ |