406 lines
35 KiB
Markdown
406 lines
35 KiB
Markdown
# IoT PreTester 4.6 — Network Capture Security Analysis
|
||
|
||
- **Capture:** `/app/files/uploads/old_init-2d7aed437f3d.pcapng`
|
||
- **Packets:** 12383 · **Duration:** 331.027 s · **Findings:** 7
|
||
- **Device under test:** `34.155.200.196` (MAC 52:54:00:71:bb:02) · device-related findings: 3, other hosts: 4
|
||
|
||
## Summary
|
||
|
||
| Severity | Count |
|
||
| ----------- | ------ |
|
||
| CRITICAL | 0 |
|
||
| HIGH | 0 |
|
||
| MEDIUM | 1 |
|
||
| LOW | 4 |
|
||
| INFO | 2 |
|
||
|
||
## Findings
|
||
|
||
### 1. Clear-text protocol: HTTP on 142.250.154.94:80
|
||
|
||
- **Severity:** MEDIUM · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
|
||
- **📍 Sources:**
|
||
- Packet #5211 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #5215 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #5219 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #5222 · Stream 134 · 10.12.0.103 → 142.250.154.94 · http:80 · Capture old_init-2d7aed437f3d.pcapng
|
||
- **Risk:** HTTP content is unencrypted and can be read or modified on the path.
|
||
- **Affected:** Source 10.12.0.103, Destination 142.250.154.94, http:80
|
||
- **Additional evidence:** Packets: 5211, 5215, 5219, 5222 | Streams: 134 | Time: 2026-07-08 08:44:30 UTC – 2026-07-08 08:44:30 UTC | port=80, packets=10, payload_bytes=373, clients=['10.12.0.103'], client_count=1, external_server=True
|
||
- **Recommendation:** Require HTTPS for all device and cloud communication.
|
||
- **Finding ID:** `d31487f489fcc8f4`
|
||
|
||
### 2. Many small outbound connections to one target
|
||
|
||
- **Severity:** LOW · **Confidence:** low · **Category:** exfiltration · **Detector:** ExfiltrationDetector
|
||
- **📍 Sources:**
|
||
- Packet #22 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #56 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #92 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #127 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #163 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #200 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #236 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #288 · 10.12.0.103 → 34.155.200.196 · Capture old_init-2d7aed437f3d.pcapng
|
||
- … and 270 more packets
|
||
- **Risk:** Many short outbound connections to one target may indicate segmented uploads or polling.
|
||
- **Affected:** Device 34.155.200.196, Source 10.12.0.103, Destination 34.155.200.196 · **involves device under test**
|
||
- **Additional evidence:** Packets: 22, 56, 92, 127, 163, 200, 236, 288 | Streams: 3, 4, 5, 6, 7, 8, 9, 13 | Time: — – — | transfer_count=278, target_names=['api.production.loqed.com', 'mqtt.production.loqed.com'], device_related=True
|
||
- **Recommendation:** Investigate the connection pattern and destination.
|
||
- **Finding ID:** `fba18730143d6ee7`
|
||
|
||
### 3. Client offers broken cipher suites
|
||
|
||
- **Severity:** LOW · **Confidence:** high · **Category:** tls_weakness · **Detector:** TlsWeaknessDetector
|
||
- **📍 Sources:**
|
||
- Packet #4086 · 2026-07-08 08:43:36 UTC · 10.12.0.102 → 17.167.200.74 · tls:443 · Capture old_init-2d7aed437f3d.pcapng
|
||
- **Risk:** The client advertises cipher suites with known weaknesses. A downgrade or a misconfigured server could select one of them.
|
||
- **Affected:** Source 10.12.0.102, Destination 17.167.200.74, tls:443, gsp85-ssl.ls.apple.com
|
||
- **Additional evidence:** Packets: 4086 | Time: 2026-07-08 08:43:36 UTC – 2026-07-08 08:43:36 UTC | weak_ciphers=['TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))', 'TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))', 'TLS_RSA_WITH_3DES_EDE_CBC_SHA (3DES (Sweet32))'], offered_total=20, target=gsp85-ssl.ls.apple.com, device_related=False
|
||
- **Recommendation:** Remove obsolete cipher suites from the client's TLS configuration.
|
||
- **Finding ID:** `9edddf1d281cdabd`
|
||
|
||
### 4. DNS sent directly to an external resolver (8.8.8.8)
|
||
|
||
- **Severity:** LOW · **Confidence:** high · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
|
||
- **📍 Sources:**
|
||
- Packet #1020 · 2026-07-08 08:41:06 UTC · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
|
||
- **Risk:** The host resolves names through a hard-coded external resolver instead of the one assigned by the network. Local DNS filtering and monitoring are bypassed and the queries are visible to a third party.
|
||
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53
|
||
- **Additional evidence:** Packets: 1020 | Time: 2026-07-08 08:41:06 UTC – 2026-07-08 08:41:06 UTC | queries=12, device_related=False
|
||
- **Recommendation:** Use the DHCP-assigned resolver, or DNS over TLS/HTTPS if privacy is required.
|
||
- **Finding ID:** `b90cea9473b87e9a`
|
||
|
||
### 5. Randomly-structured DNS name observed
|
||
|
||
- **Severity:** LOW · **Confidence:** low · **Category:** dns_anomaly · **Detector:** DnsAnomalyDetector
|
||
- **🔎 Observed artifact:** `Domain: intercom.com`
|
||
- **📍 Sources:**
|
||
- Packet #1020 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #1021 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #6965 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
|
||
- Packet #6966 · 10.12.0.200 → 8.8.8.8 · dns:53 · Capture old_init-2d7aed437f3d.pcapng
|
||
- **Risk:** A DNS name with a random-looking label was queried under intercom.com. In isolation this is a weak indicator; it becomes significant only alongside many such names or other anomalies.
|
||
- **Affected:** Source 10.12.0.200, Destination 8.8.8.8, dns:53, intercom.com
|
||
- **Additional evidence:** Packets: 1020, 1021, 6965, 6966 | Time: 2026-07-08 08:41:06 UTC – 2026-07-08 08:41:06 UTC | registered_domain=intercom.com, distinct_random_subdomains=1, examples=['n1cez2fg-android.mobile-messenger'], device_related=False
|
||
- **Recommendation:** Confirm the domain is a legitimate service; otherwise check it against threat intelligence.
|
||
- **Finding ID:** `26d5761b2c0d5e1c`
|
||
|
||
### 6. Device offers a network service on port 443
|
||
|
||
- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
|
||
- **📍 Sources:**
|
||
- ? → 34.155.200.196 · tls:443 · Capture old_init-2d7aed437f3d.pcapng · aggregated evidence; no single packet is available
|
||
- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
|
||
- **Affected:** Device 34.155.200.196, Destination 34.155.200.196, tls:443 · **involves device under test**
|
||
- **Additional evidence:** Time: — – — | port=443, protocols=['tls'], device_related=True
|
||
- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise.
|
||
- **Finding ID:** `9080003b793ca322`
|
||
|
||
### 7. Device offers a network service on port 8883
|
||
|
||
- **Severity:** INFO · **Confidence:** high · **Category:** insecure_protocol · **Detector:** InsecureProtocolDetector
|
||
- **📍 Sources:**
|
||
- ? → 34.155.200.196 · tls:8883 · Capture old_init-2d7aed437f3d.pcapng · aggregated evidence; no single packet is available
|
||
- **Risk:** The device accepted connections on this port. Every listening service is attack surface and should be known and justified.
|
||
- **Affected:** Device 34.155.200.196, Destination 34.155.200.196, tls:8883 · **involves device under test**
|
||
- **Additional evidence:** Time: — – — | port=8883, protocols=['tls'], device_related=True
|
||
- **Recommendation:** Confirm the service is required, authenticated and encrypted; disable it otherwise.
|
||
- **Finding ID:** `e033c2ed522bde4e`
|
||
|
||
|
||
## Observation Inventory
|
||
|
||
- Capture: 12383 packets, 331.027 s, 10 internal and 37 external hosts, 410 flows, VLANs 1, 200 · extractor tshark 4.4.19
|
||
|
||
### Device under test
|
||
- `34.155.200.196` · MAC 52:54:00:71:bb:02 · names —
|
||
- 9968 packets · sent 1.4 MB · received 736.6 kB · first seen 2026-07-08 08:40:37 UTC · last seen 2026-07-08 08:46:01 UTC
|
||
- Services offered: 443, 8883 · ports contacted: —
|
||
- Protocols: tls · TLS sessions: 0 · clear-text flows: 0
|
||
- Peers (2):
|
||
- `10.12.0.103` · internal · ports 33854, 33856, 33870, 33876, 33880, 33896, 33912, 33922, 33926, 33940, 33956, 33960, 33970, 33982, 33996, 34002, 34016, 34020, 34032, 34038 · tls · to peer 1.4 MB / from peer 732.2 kB
|
||
- `10.12.0.104` (loqed-8c4b146a1acc._http._tcp.local) · internal · ports 50167 · tls · to peer 6.7 kB / from peer 4.5 kB
|
||
|
||
### Internal hosts (10)
|
||
- `10.12.0.103` · MAC 6e:bd:64:d7:9a:69 · 11149 packets · offers 33054, 53758, 53770, 53772, 53778, 53794, 53808, 55340 · 19 external endpoints
|
||
- `10.12.0.102` (iphone) · MAC d6:cd:eb:e5:d1:75 · 697 packets · offers — · 14 external endpoints
|
||
- `10.12.0.104` (loqed-8c4b146a1acc) · MAC 8c:4b:14:6a:1a:cc · 275 packets · offers — · 3 external endpoints
|
||
- `10.12.0.250` · MAC 52:54:00:71:bb:02 · 106 packets · offers 53 · 0 external endpoints
|
||
- `fe80::10f6:c22e:fe1c:d27a` (iphone) · MAC d6:cd:eb:e5:d1:75 · 63 packets · offers — · 0 external endpoints
|
||
- `10.12.0.200` · MAC c8:7f:54:de:c0:38 · 42 packets · offers — · 1 external endpoints
|
||
- `fe80::6cbd:64ff:fed7:9a69` · MAC 6e:bd:64:d7:9a:69 · 39 packets · offers — · 0 external endpoints
|
||
- `fe80::ca7f:54ff:fede:c038` · MAC c8:7f:54:de:c0:38 · 4 packets · offers — · 0 external endpoints
|
||
- `192.168.42.75` · MAC — · 4 packets · offers — · 0 external endpoints
|
||
- `10.12.0.101` · MAC — · 2 packets · offers — · 1 external endpoints
|
||
|
||
### External endpoints (37)
|
||
- `34.155.200.196` (api.production.loqed.com, mqtt.production.loqed.com) · ports 443, 8883 · tls · encrypted · out 736.6 kB / in 1.4 MB
|
||
- `17.253.57.197` (captive.apple.com, cl2.apple.com) · ports 443 · tls · encrypted · out 8.6 kB / in 251.1 kB
|
||
- `216.239.36.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · quic, tls · encrypted · out 54.2 kB / in 179.6 kB
|
||
- `142.251.127.101` (encrypted-tbn0.gstatic.com) · ports 443 · tls · encrypted · out 16.0 kB / in 207.8 kB
|
||
- `142.251.152.119` (www.google.com) · ports 443 · tls · encrypted · out 5.4 kB / in 95.1 kB
|
||
- `142.251.110.95` (www.googleapis.com) · ports 443 · quic, tls · encrypted · out 10.8 kB / in 88.9 kB
|
||
- `142.251.13.113` (encrypted-tbn1.gstatic.com) · ports 443 · tls · encrypted · out 7.1 kB / in 33.2 kB
|
||
- `142.250.154.139` (encrypted-tbn3.gstatic.com) · ports 443 · tls · encrypted · out 6.4 kB / in 16.7 kB
|
||
- `17.57.146.56` (25-courier.push.apple.com, courier.push.apple.com) · ports 5223 · tls · encrypted · out 16.8 kB / in 6.1 kB
|
||
- `199.232.191.6` (bag.itunes.apple.com) · ports 443 · quic, tls · encrypted · out 6.0 kB / in 16.5 kB
|
||
- `216.239.38.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · quic, tls · encrypted · out 11.7 kB / in 10.1 kB
|
||
- `40.104.206.18` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 7.1 kB / in 14.1 kB
|
||
- `98.90.70.94` (n1cez2fg-android.mobile-messenger.intercom.com) · ports 443 · tls · encrypted · out 4.8 kB / in 15.6 kB
|
||
- `17.248.209.81` (gateway.icloud.com) · ports 443, 61000 · icmp, quic, tls · encrypted · out 11.4 kB / in 8.6 kB
|
||
- `216.239.34.223` (discover-pa.googleapis.com, play.googleapis.com, prod-lt-playstoregatewayadapter-pa.googleapis.com, remoteprovisioning.googleapis.com, spot-pa.googleapis.com) · ports 443 · tls · encrypted · out 5.6 kB / in 10.6 kB
|
||
- `172.224.55.5` (mask.icloud.com) · ports 443 · quic, tls · encrypted · out 8.3 kB / in 7.8 kB
|
||
- `54.144.197.43` (n1cez2fg-android.mobile-messenger.intercom.com) · ports 443 · tls · encrypted · out 3.7 kB / in 9.2 kB
|
||
- `17.188.143.125` (init.push.apple.com) · ports 443 · tls · encrypted · out 2.5 kB / in 8.1 kB
|
||
- `17.253.57.195` (captive.apple.com, cl2.apple.com) · ports 443 · tls · encrypted · out 2.4 kB / in 7.5 kB
|
||
- `17.253.15.139` (configuration.ls.apple.com) · ports 443 · tls · encrypted · out 2.8 kB / in 6.7 kB
|
||
- `17.167.200.74` (gsp85-ssl.ls.apple.com) · ports 443 · tls · encrypted · out 3.0 kB / in 5.8 kB
|
||
- `18.97.36.75` (nexus-websocket-a.intercom.io) · ports 443 · tls · encrypted · out 2.2 kB / in 6.5 kB
|
||
- `2.16.16.110` (gspe1-ssl.ls.apple.com) · ports 443 · tls · encrypted · out 3.8 kB / in 4.9 kB
|
||
- `63.181.149.124` (hooks.nabu.casa) · ports 443 · tls · encrypted · out 1.9 kB / in 5.6 kB
|
||
- `142.250.154.94` (connectivitycheck.gstatic.com) · ports 80, 443 · http, tls · encrypted · out 2.1 kB / in 4.6 kB
|
||
- `142.251.20.113` · ports 443 · tls · encrypted · out 3.4 kB / in 2.4 kB
|
||
- `40.101.70.194` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
|
||
- `52.97.105.162` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
|
||
- `40.101.69.226` (m.hotmail.com) · ports 443 · quic, tls · encrypted · out 2.4 kB / in 1.2 kB
|
||
- `8.8.8.8` · ports 53, 59560 · dns, icmp · clear-text or unknown · out 1.2 kB / in 1.9 kB
|
||
- `142.251.157.119` (www.google.com) · ports 443 · tls · encrypted · out 1.5 kB / in 1.6 kB
|
||
- `18.97.36.19` · ports 443 · tls · encrypted · out 350 B / in 446 B
|
||
- `142.251.127.188` · ports 5228 · tls · encrypted · out 166 B / in 164 B
|
||
- `31.13.84.49` · ports 5222 · undecoded · clear-text or unknown · out 0 B / in 236 B
|
||
- `3.91.171.254` · ports 443 · tls · encrypted · out 164 B / in 58 B
|
||
- `91.206.8.34` (pool.ntp.org) · ports 123 · ntp · clear-text or unknown · out 94 B / in 94 B
|
||
- `142.251.156.119` (www.google.com) · ports 443 · undecoded · clear-text or unknown · out 70 B / in 58 B
|
||
|
||
### Services observed (45)
|
||
- `34.155.200.196:443` https (tcp) ← device · encrypted · 277 flows from 1 clients
|
||
- `34.155.200.196:8883` mqtts (tcp) ← device · encrypted · 1 flows from 1 clients
|
||
- `10.12.0.102:443` https (udp) · unknown · 1 flows from 1 clients
|
||
- `10.12.0.200:53` dns (udp) · unknown · 6 flows from 2 clients
|
||
- `10.12.0.250:53` dns (udp) · unknown · 48 flows from 4 clients
|
||
- `142.250.154.139:443` https (tcp) · encrypted · 2 flows from 1 clients
|
||
- `142.250.154.94:80` http (tcp) · clear-text · 1 flows from 1 clients
|
||
- `142.250.154.94:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `142.251.110.95:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `142.251.127.101:443` https (tcp) · encrypted · 4 flows from 1 clients
|
||
- `142.251.127.188:5228` gcm (tcp) · encrypted · 1 flows from 1 clients
|
||
- `142.251.13.113:443` https (tcp) · encrypted · 2 flows from 1 clients
|
||
- `142.251.152.119:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `142.251.156.119:443` https (tcp) · unknown · 1 flows from 1 clients
|
||
- `142.251.157.119:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `142.251.20.113:443` https (tcp) · encrypted · 5 flows from 1 clients
|
||
- `17.167.200.74:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `17.188.143.125:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `17.248.209.81:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `17.253.15.139:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `17.253.57.195:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `17.253.57.197:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `17.57.146.56:5223` apns (tcp) · encrypted · 1 flows from 1 clients
|
||
- `172.224.55.5:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `172.224.55.5:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `18.97.36.19:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `18.97.36.75:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `199.232.191.6:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `2.16.16.110:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `216.239.34.223:443` https (tcp) · encrypted · 7 flows from 1 clients
|
||
- `216.239.36.223:443` quic (udp) · encrypted · 2 flows from 1 clients
|
||
- `216.239.38.223:443` https (tcp) · encrypted · 2 flows from 1 clients
|
||
- `216.239.38.223:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `3.91.171.254:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `31.13.84.49:5222` xmpp (tcp) · unknown · 1 flows from 1 clients
|
||
- `40.101.69.226:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `40.101.70.194:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `40.104.206.18:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `40.104.206.18:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `52.97.105.162:443` quic (udp) · encrypted · 1 flows from 1 clients
|
||
- `54.144.197.43:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `63.181.149.124:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
- `8.8.8.8:53` dns (udp) · unknown · 12 flows from 1 clients
|
||
- `91.206.8.34:123` ntp (udp) · unknown · 1 flows from 1 clients
|
||
- `98.90.70.94:443` https (tcp) · encrypted · 1 flows from 1 clients
|
||
|
||
### Protocols (packets)
|
||
- ip 12180, tcp 11373, tls 5469, udp 879, quic 541, mdns 189, dns 126, ipv6 115, arp 79, icmpv6 28, dhcp 20, igmp 15, icmp 7, ipv6.hopopts 6, http 2, ntp 2
|
||
- ICMP: router_advertisement 3, unreachable 7, router_solicitation 12, neighbor_solicitation 6, icmpv6_type_143 6, neighbor_advertisement 1
|
||
|
||
### TLS posture (320 handshakes)
|
||
- Versions: TLS 1.2 ×285, TLS 1.3 ×30
|
||
- Cipher suites: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ×284, TLS_AES_128_GCM_SHA256 ×12, TLS_AES_256_GCM_SHA384 ×18, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ×1
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2
|
||
- 10.12.0.103 → `34.155.200.196:443` (api.production.loqed.com) ← device · TLS 1.2 · TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 · client max TLS 1.2 · cert api.production.loqed.com by YR1, expires 2026-10-02 03:13:03 UTC
|
||
|
||
### DNS (129 queries, 66 responses, 46 names)
|
||
- Response codes: NOERROR 60, NXDOMAIN 6 · resolvers: 8.8.8.8 (12), 10.12.0.250 (48), 10.12.0.200 (6)
|
||
- `_rdlink._tcp.local` · 21× · PTR · no answer seen
|
||
- `1225c5c3-e802-4057-a9d9-4c2aa8527e4d._asquic._udp.local` · 18× · ANY · no answer seen
|
||
- `i0jzqvr8n14aaa._fc9f5ed42c8a._tcp.local` · 18× · ANY · no answer seen
|
||
- `loqed-8c4b146a1acc._http._tcp.local` · 12× · ANY · no answer seen
|
||
- `n1cez2fg-android.mobile-messenger.intercom.com` · 4× · A · 100.60.6.237, 107.20.239.244, 52.70.57.139, 54.144.197.43, 54.210.239.62, 98.90.70.94
|
||
- `www.google.com` · 3× · A · 142.251.150.119, 142.251.151.119, 142.251.152.119, 142.251.153.119, 142.251.154.119, 142.251.155.119
|
||
- `25-courier.push.apple.com` · 2× · A, HTTPS · 17.57.146.54, 17.57.146.55, 17.57.146.56, 17.57.146.57, 17.57.146.58, 17.57.146.59
|
||
- `bag.itunes.apple.com` · 2× · A, HTTPS · 199.232.191.6
|
||
- `captive.apple.com` · 2× · A, HTTPS · 17.253.57.195, 17.253.57.197
|
||
- `cl2.apple.com` · 2× · A, HTTPS · 17.253.57.195, 17.253.57.197
|
||
- `configuration.ls.apple.com` · 2× · A, HTTPS · 17.253.15.139, 17.253.15.147
|
||
- `connectivitycheck.gstatic.com` · 2× · A · 142.250.154.94, 142.251.20.94
|
||
- `gsp85-ssl.ls.apple.com` · 2× · A, HTTPS · 17.167.200.74
|
||
- `gspe1-ssl.ls.apple.com` · 2× · A, HTTPS · 2.16.16.100, 2.16.16.110
|
||
- `init.push.apple.com` · 2× · A, HTTPS · 17.188.143.125, 17.188.143.126, 17.188.143.189, 17.188.178.226, 17.188.178.34, 17.188.179.2
|
||
- `m.hotmail.com` · 2× · A, HTTPS · 40.101.69.226, 40.101.70.194, 40.104.206.18, 52.97.105.162
|
||
- `mask.icloud.com` · 2× · A, HTTPS · 172.224.55.10, 172.224.55.11, 172.224.55.13, 172.224.55.4, 172.224.55.5, 172.224.55.7
|
||
- `nexus-websocket-a.intercom.io` · 2× · A · 18.97.36.13, 18.97.36.14, 18.97.36.18, 18.97.36.2, 18.97.36.47, 18.97.36.49
|
||
- `www.googleapis.com` · 2× · A · 142.250.154.95, 142.251.110.95, 142.251.127.95, 142.251.13.95, 142.251.14.95, 142.251.20.95
|
||
- `_dns.resolver.arpa` · 1× · SVCB · no answer seen
|
||
- `a1366.dscapi6.akamai.net` · 1× · HTTPS · no answer seen
|
||
- `api.production.loqed.com` · 1× · A · 34.155.200.196
|
||
- `captive.g.aaplimg.com` · 1× · HTTPS · no answer seen
|
||
- `cl2.g.aaplimg.com` · 1× · HTTPS · no answer seen
|
||
- `configuration.ls.v.aaplimg.com` · 1× · HTTPS · no answer seen
|
||
- `discover-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
|
||
- `encrypted-tbn0.gstatic.com` · 1× · A · 142.251.127.100, 142.251.127.101, 142.251.127.102, 142.251.127.113, 142.251.127.138, 142.251.127.139
|
||
- `encrypted-tbn1.gstatic.com` · 1× · A · 142.251.13.100, 142.251.13.101, 142.251.13.102, 142.251.13.113, 142.251.13.138, 142.251.13.139
|
||
- `encrypted-tbn3.gstatic.com` · 1× · A · 142.250.154.100, 142.250.154.101, 142.250.154.102, 142.250.154.113, 142.250.154.138, 142.250.154.139
|
||
- `eu-central-courier-4.push-apple.com.akadns.net` · 1× · HTTPS · no answer seen
|
||
- `gsp85-ssl.ls2-apple.com.akadns.net` · 1× · HTTPS · no answer seen
|
||
- `hooks.nabu.casa` · 1× · A · 3.73.212.91, 63.181.149.124
|
||
- `init.push-apple.com.akadns.net` · 1× · HTTPS · no answer seen
|
||
- `lb._dns-sd._udp.0.0.12.10.in-addr.arpa` · 1× · PTR · no answer seen
|
||
- `lb._dns-sd._udp.15.89.76.100.in-addr.arpa` · 1× · PTR · no answer seen
|
||
- `lb._dns-sd._udp.56.111.171.10.in-addr.arpa` · 1× · PTR · no answer seen
|
||
- `lb._dns-sd._udp.6.0.0.192.in-addr.arpa` · 1× · PTR · no answer seen
|
||
- `lb._dns-sd._udp.jrz-iot.mci.edu` · 1× · PTR · no answer seen
|
||
- `mask.apple-dns.net` · 1× · HTTPS · no answer seen
|
||
- `mqtt.production.loqed.com` · 1× · A · 34.155.200.196
|
||
- `play.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
|
||
- `pool.ntp.org` · 1× · A · 152.53.100.131, 152.53.119.76, 46.102.157.67, 91.206.8.34
|
||
- `prod-lt-playstoregatewayadapter-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
|
||
- `remoteprovisioning.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
|
||
- `spot-pa.googleapis.com` · 1× · A · 216.239.32.223, 216.239.34.223, 216.239.36.223, 216.239.38.223
|
||
- `vie-efz.ms-acdc.office.com` · 1× · HTTPS · no answer seen
|
||
|
||
### HTTP (2 requests)
|
||
- `connectivitycheck.gstatic.com` · 1 requests · GET · /generate_204
|
||
- `10.12.0.103` · 1 requests · · /generate_204
|
||
|
||
### Clear-text protocols and service events
|
||
- http: 1 flows, 373 B · 10.12.0.103 -> 142.250.154.94:80
|
||
- xmpp: 1 flows, 96 B · 10.12.0.101 -> 31.13.84.49:5222
|
||
- https: 1 flows, 21 B · 17.248.209.81 -> 10.12.0.102:443
|
||
- icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1)
|
||
- icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1)
|
||
- icmpv6 router_advertisement: (fe80::ca7f:54ff:fede:c038 → ff02::1)
|
||
- DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —)
|
||
- DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —)
|
||
- DHCP request: d6:cd:eb:e5:d1:75 iPhone → 10.12.0.102 (server —)
|
||
- DHCP ack: d6:cd:eb:e5:d1:75 iphone → 10.12.0.102 (server 10.12.0.250)
|
||
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
|
||
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
|
||
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
|
||
- DHCP offer: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
|
||
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
|
||
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
|
||
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
|
||
- DHCP ack: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
|
||
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
|
||
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
|
||
- DHCP discover: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → (server —)
|
||
- DHCP offer: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
|
||
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
|
||
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
|
||
- DHCP request: 8c:4b:14:6a:1a:cc LOQED-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
|
||
- DHCP ack: 8c:4b:14:6a:1a:cc loqed-8c4b146a1acc → 10.12.0.104 (server 10.12.0.250)
|
||
|
||
### Coverage
|
||
- Complete extraction · 410 flows, 330 encrypted, 1 with undecoded payload · 4 clear-text payloads scanned
|
||
- Undecoded ports (flows): 5222: 1
|
||
- Flows with application data that tshark did not decode (port: flows): 5222: 1
|
||
- 30 TLS 1.3 sessions: server certificates are encrypted and could not be inspected.
|
||
|
||
## Cloud URLs and Endpoints (54)
|
||
|
||
- `1225c5c3-e802-4057-a9d9-4c2aa8527e4d._asquic._udp.local` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `142.251.127.188` — Ports: 443, 5228; TLS: N/A; Cipher: N/A
|
||
- `142.251.20.113` — Ports: 80, 443; TLS: N/A; Cipher: N/A
|
||
- `18.97.36.19` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `25-courier.push.apple.com` — Ports: 443; TLS: N/A; Cipher: N/A
|
||
- `3.91.171.254` — Ports: 443; TLS: N/A; Cipher: N/A
|
||
- `31.13.84.49` — Ports: 80, 443, 5222; TLS: N/A; Cipher: N/A
|
||
- `8.8.8.8` — Ports: 53, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `_dns.resolver.arpa` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `_rdlink._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `a1366.dscapi6.akamai.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A
|
||
- `api.production.loqed.com` — Ports: 80, 443, 8080; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
|
||
- `bag.itunes.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `captive.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `captive.g.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
|
||
- `cl2.apple.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
|
||
- `cl2.g.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
|
||
- `configuration.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `configuration.ls.v.aaplimg.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
|
||
- `connectivitycheck.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `courier.push.apple.com` — Ports: 443, 5223; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `discover-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `encrypted-tbn0.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `encrypted-tbn1.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `encrypted-tbn3.gstatic.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `eu-central-courier-4.push-apple.com.akadns.net` — Ports: 443; TLS: N/A; Cipher: N/A
|
||
- `gateway.icloud.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `gsp85-ssl.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `gsp85-ssl.ls2-apple.com.akadns.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A
|
||
- `gspe1-ssl.ls.apple.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `hooks.nabu.casa` — Ports: 443, 8000; TLS: TLSv1.2; Cipher: ECDHE-RSA-AES128-GCM-SHA256
|
||
- `i0jzqvr8n14aaa._fc9f5ed42c8a._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `init.push-apple.com.akadns.net` — Ports: 443; TLS: N/A; Cipher: N/A
|
||
- `init.push.apple.com` — Ports: 443; TLS: N/A; Cipher: N/A
|
||
- `lb._dns-sd._udp.0.0.12.10.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `lb._dns-sd._udp.15.89.76.100.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `lb._dns-sd._udp.56.111.171.10.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `lb._dns-sd._udp.6.0.0.192.in-addr.arpa` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `lb._dns-sd._udp.jrz-iot.mci.edu` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `loqed-8c4b146a1acc._http._tcp.local` — Ports: —; TLS: N/A; Cipher: N/A
|
||
- `m.hotmail.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `mask.apple-dns.net` — Ports: 80, 443; TLS: N/A; Cipher: N/A
|
||
- `mask.icloud.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
|
||
- `mqtt.production.loqed.com` — Ports: 80, 443, 8080, 8883; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
|
||
- `n1cez2fg-android.mobile-messenger.intercom.com` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_128_GCM_SHA256
|
||
- `nexus-websocket-a.intercom.io` — Ports: 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `play.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `pool.ntp.org` — Ports: 22; TLS: N/A; Cipher: N/A
|
||
- `prod-lt-playstoregatewayadapter-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `remoteprovisioning.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `spot-pa.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `vie-efz.ms-acdc.office.com` — Ports: 80, 443; TLS: N/A; Cipher: N/A
|
||
- `www.google.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
- `www.googleapis.com` — Ports: 80, 443; TLS: TLSv1.3; Cipher: TLS_AES_256_GCM_SHA384
|
||
|
||
---
|
||
_Generated by IoT PreTester 4.6 · Detectors: PlaintextCredentialDetector, PasswordHashDetector, TokenSecretDetector, MalwareBeaconingDetector, ExfiltrationDetector, MitmDetector, InsecureProtocolDetector, TlsWeaknessDetector, DnsAnomalyDetector, BruteforceScanFileTransferDetector_ |