Generated 2026-10-17 10:16 · iotaudit 0.1.0 · source: arp:en0 (anonymized sample) · capture 900s
Findings are indicators based on observed traffic, not proof of wrongdoing by any vendor.
All data was processed locally. IP Geolocation by DB-IP (https://db-ip.com).
D
192.168.0.50
MAC 14:5d:34:00:00:01 · SHENZHEN BILIAN ELECTRONIC
· profile: iotbing.com cloud device (Tuya-associated pet feeder / camera) · score 55/100
Summary. Device 192.168.0.50 (iotbing.com cloud device (Tuya-associated pet feeder / camera)). Grade D (55/100). Talked to: Amazon AWS, Google, OVH, iotbing (Tuya-associated cloud). Server countries observed: US. Telnet (port 23) is open on the LAN — change defaults / block it. Uses public DNS directly (bypasses your router). Used STUN/TURN (typical for P2P video setup). A P2P video session was set up but no media stream was captured here — it likely went straight to your phone over Wi-Fi (not observed). Uploads while app idle: insufficient data. 1 destination(s) look like custom/non-TLS encryption (unverified).
Uploads while app idle: insufficient data
IPv6: 1 flow(s),
168 bytes (168 on link-local fe80::); NDP messages:
2
(NS 1, NA 1), neighbours 1.
Findings
- [medium] Non-standard encryption (custom protocol), unverified — Traffic to 15.204.79.232 (ports [1443]) looks encrypted by entropy but is not TLS. High entropy (8.00) without TLS handshake — non-standard encryption (custom protocol), unverified. confidence: medium
- [info] STUN/TURN (P2P video setup) — STUN/TURN to 15.204.72.48 (OVH) — typical for peer-to-peer video/audio; the media may stay on the LAN or go via a relay. confidence: high
- [medium] Hardcoded public DNS (bypasses router) — Device sent DNS to 8.8.8.8, bypassing your router's DNS. Queries may leave your network even if you run Pi-hole.
- [high] Open port 23/tcp (telnet) — Telnet exposes an unencrypted login shell.
- [info] Cloud servers outside the local network — Observed destination countries: US. This is a location note about servers the device contacted, not a judgement about where you live.
- [info] Odd "LAN peer" in special-use address space — Saw traffic to/from 192.0.0.6 (3360B), which is reserved / protocol-assignment space (e.g. 192.0.0.0/24), not a real device on your Wi-Fi. It is almost always a placeholder/DS-Lite address or an address carried inside P2P/STUN signalling — not a second hidden gadget. confidence: high
- [info] LAN discovery broadcasts — 48000 bytes of broadcast/multicast (e.g. Tuya UDP 6667) — not media.
- [info] Live video set up but not observed here — The device negotiated a peer-to-peer session (STUN/TURN) but no sustained video/audio stream was captured on this run. It most likely went directly between the device and your phone over Wi-Fi (P2P) and never passed through this computer: two Wi-Fi clients can talk without their traffic crossing your Mac, and spoofed ARP/NDP may not redirect it (client isolation, or the phone ignoring the spoof). IPv6 was active (NDP messages: 2, IPv6 flows seen: 1), so the stream may be riding IPv6 link-local between the two devices. Not observed does not mean it did not happen — re-run with the app streaming, or capture at the router. confidence: high
- [info] IPv6 traffic observed — 1 IPv6 flow(s), 168 bytes (168 on link-local fe80::); NDP neighbor-discovery messages: 2. IPv6 enrichment (country/org) is limited; link-local P2P between two Wi-Fi clients may not be fully capturable without router-side capture.
Internet destinations
| Domain(s) | IP | Country | Organisation | Ports / proto | Bytes | Encryption | Class |
|---|
| — |
15.204.79.232 | US | OVH |
1443 (custom-1443) |
72000 out / 72000 in |
custom (unverified)
|
— |
| — |
52.32.71.30 | US | Amazon AWS |
8883 (MQTT-over-TLS) |
23000 out / 23000 in |
TLS/encrypted
|
— |
| a1-us.iotbing.com |
35.155.252.83 | US | iotbing (Tuya-associated cloud) |
443 (HTTPS) |
17000 out / 17000 in |
TLS/encrypted
|
— |
| — |
15.204.72.48 | US | OVH |
3478 (STUN/TURN) |
4000 out / 4000 in |
STUN/TURN
|
— |
| — |
8.8.8.8 | US | Google |
53 (DNS) |
200 out / 0 in |
TLS/encrypted
|
— |
LAN peers (same Wi-Fi — often phone P2P video)
| IP | Ports | Bytes | Class |
|---|
| 192.0.0.6 special-use / not a real device |
63720 | 3360 out / 0 in |
bogon/placeholder |
Open ports (LAN)
| Port | Service | Product | Risk |
|---|
| 23/tcp | telnet | BusyBox telnetd |
high |