Anomalies
8 things worth a second look.
- Worth a look
- 0
- Detectors run
- 0
across all detectors
of 5
Encrypted-DNS bypass
Devices looking up a public DoH or DoT resolver. Before anything can route around this box it has to ask this box where that resolver lives, which is the one query it cannot hide.
One device looked up a public resolver. A lookup is intent rather than proof (software often checks whether one is reachable without going on to use it), but any traffic that does move there stops appearing anywhere in this dashboard.
- Evidence →
Google Public DNS
dns.google
65 lookups from Pixel 8 (guest).
- Evidence →
Cloudflare DNS
cloudflare-dns.com
42 lookups from Pixel 8 (guest).
Firefox asked the DoH canary (use-application-dns.net) 29 times. It is being blocked, which is the correct answer: that is how Firefox is told to keep using this resolver.
New devices
Something joined the network and started resolving names.
Nothing matched in this range.
Possible tunnelling
Subdomain patterns consistent with data being encoded into DNS.
Nothing matched in this range.
Beaconing
A device contacting one domain with machine-like regularity.
- Evidence →
Front door Ring contacts s3.eu-west-1.amazonaws.com on a schedule
403 queries across 24 hours, averaging 16.8 per hour with very little variation (±24%). Regular to that degree is usually a keep-alive or telemetry timer rather than anything a person did.
- Evidence →
Hue bridge contacts mqtt.philips-hue.com on a schedule
472 queries across 25 hours, averaging 18.9 per hour with very little variation (±28%). Regular to that degree is usually a keep-alive or telemetry timer rather than anything a person did.
- Evidence →
Synology NAS contacts update7.synology.com on a schedule
519 queries across 25 hours, averaging 20.8 per hour with very little variation (±29%). Regular to that degree is usually a keep-alive or telemetry timer rather than anything a person did.
- Evidence →
Front door Ring contacts fw-updates.ring.com on a schedule
468 queries across 25 hours, averaging 18.7 per hour with very little variation (±31%). Regular to that degree is usually a keep-alive or telemetry timer rather than anything a person did.
- Evidence →
Front door Ring contacts device-metrics-us.amazon.com on a schedule
420 queries across 24 hours, averaging 17.5 per hour with very little variation (±32%). Regular to that degree is usually a keep-alive or telemetry timer rather than anything a person did.
- Evidence →
Synology NAS contacts s3.eu-west-1.amazonaws.com on a schedule
289 queries across 25 hours, averaging 11.6 per hour with very little variation (±37%). Regular to that degree is usually a keep-alive or telemetry timer rather than anything a person did.
- Evidence →
Pixel 8 (guest) contacts cloudflare-dns.com on a schedule
42 queries across 18 hours, averaging 2.3 per hour with very little variation (±43%). Regular to that degree is usually a keep-alive or telemetry timer rather than anything a person did.
- Evidence →
Brother printer contacts www.brother.com on a schedule
54 queries across 17 hours, averaging 3.2 per hour with very little variation (±44%). Regular to that degree is usually a keep-alive or telemetry timer rather than anything a person did.
New destinations
Traffic resolving to a country this network has never reached.
Nothing matched in this range.
Gone quiet
Devices that were busy and then stopped.
Nothing matched in this range.