iotaudit report

Generated 2026-10-22 19:07 · iotaudit 0.1.5 · source: arp:en0 (anonymized sample) · capture 900s

Findings are indicators based on observed traffic, not proof of wrongdoing by any vendor. All data was processed locally. IP Geolocation by DB-IP (https://db-ip.com).

192.168.0.50

MAC 14:5d:34:00:00:01 · SHENZHEN BILIAN ELECTRONIC · profile: iotbing.com cloud device (Tuya-associated pet feeder / camera) · score 55/100

Looks like a Smart plug / bulb / switch type confidence: low
why: domain ~iotbing -> plug/bulb

Summary. Device 192.168.0.50 (iotbing.com cloud device (Tuya-associated pet feeder / camera)). Grade D (55/100). Talked to: Amazon AWS, Google, OVH, iotbing (Tuya-associated cloud). Observed destination countries: US (116200 bytes out). Traffic pattern indicators (not proof): looks like peer-to-peer session setup on internet (confidence high); looks like telemetry on internet (confidence medium). Telnet (port 23) is open on the LAN. Change defaults or block it. Uses public DNS directly (bypasses your router). Used STUN/TURN (typical for P2P video setup). A P2P video session was set up but no media stream was captured here. It likely went straight to your phone over Wi-Fi (not observed). Uploads while app idle: none detected. Traffic pattern: 0 active burst(s) detected. 1 destination(s) look like custom/non-TLS encryption (unverified).

Destination countries observed

Countries of servers this device contacted, from a local lookup of the IP. This is an observed fact.

US: 5 destination(s), 116200 bytes out / 116000 bytes in, Amazon AWS, Google, OVH, iotbing (Tuya-associated cloud)

Traffic patterns indicator

Video, audio, telemetry, unknown, and peer-to-peer session setup are pattern matches. A match is not proof of what was sent.

confidence: high Pattern looks like peer-to-peer session setup (internet, 1 destination(s)). Confidence: high. Indicator only, not proof of what was sent.
confidence: medium Pattern looks like telemetry (internet, 4 destination(s)). Confidence: medium. Indicator only, not proof of what was sent.

Uploads while app idle: none detected

IPv6: 1 flow(s), 168 bytes (168 on link-local fe80::); NDP messages: 2 (NS 1, NA 1), neighbours 1.

Traffic over time (10s buckets)

Bursts: idle 116010B

Findings

[medium] Non-standard encryption (custom protocol), unverified: Traffic to 15.204.79.232 (ports [1443]) looks encrypted by entropy but is not TLS. High entropy (8.00) without a TLS handshake. Non-standard encryption (custom protocol), unverified. confidence: medium
[info] STUN/TURN (P2P video setup): STUN/TURN to 15.204.72.48 (OVH), typical for peer-to-peer video/audio. The media may stay on the LAN or go via a relay. confidence: high
[medium] Hardcoded public DNS (bypasses router): Device sent DNS to 8.8.8.8, bypassing your router's DNS. Queries may leave your network even if you run Pi-hole.
[high] Open port 23/tcp (telnet): Telnet exposes an unencrypted login shell.
[info] Cloud servers outside the local network: Observed destination countries: US (116200 bytes out, 5 destination(s)). Country is a local lookup of an IP this device contacted (an observed fact), not a guess, and not a judgement about where you live.
[info] Traffic pattern looks like telemetry (indicator): Pattern looks like telemetry (internet, 4 destination(s)). Confidence: medium. Indicator only, not proof of what was sent. Low volume (~151 bit/s). Indicator: looks like telemetry or control, not proof. confidence: medium
[info] Odd "LAN peer" in special-use address space: Saw traffic to/from 192.0.0.6 (3360B), which is reserved / protocol-assignment space (e.g. 192.0.0.0/24), not a real device on your Wi-Fi. It is almost always a placeholder/DS-Lite address or an address carried inside P2P/STUN signalling, not a second hidden gadget. confidence: high
[info] LAN discovery broadcasts: 48000 bytes of broadcast/multicast (e.g. Tuya UDP 6667), not media.
[info] Live video set up but not observed here: The device negotiated a peer-to-peer session (STUN/TURN) but no sustained video/audio stream was captured on this run. It most likely went directly between the device and your phone over Wi-Fi (P2P) and never passed through this computer: two Wi-Fi clients can talk without their traffic crossing your Mac, and spoofed ARP/NDP may not redirect it (client isolation, or the phone ignoring the spoof). IPv6 was active (NDP messages: 2, IPv6 flows seen: 1), so the stream may be riding IPv6 link-local between the two devices. Not observed does not mean it did not happen. Re-run with the app streaming, or capture at the router. confidence: high
[info] IPv6 traffic observed: 1 IPv6 flow(s), 168 bytes (168 on link-local fe80::); NDP neighbor-discovery messages: 2. IPv6 enrichment (country/org) is limited; link-local P2P between two Wi-Fi clients may not be fully capturable without router-side capture.

Internet destinations

Domain(s)	IP	Country	Organisation	Ports / proto	Bytes	Encryption	Class
none	15.204.79.232	US	OVH	1443 (custom-1443)	72000 out / 72000 in	custom (unverified)	looks like telemetry confidence: medium Low volume (~640 bit/s). Indicator: looks like telemetry or control, not proof.
none	52.32.71.30	US	Amazon AWS	8883 (MQTT-over-TLS)	23000 out / 23000 in	TLS/encrypted	looks like telemetry confidence: medium Low volume (~204 bit/s). Indicator: looks like telemetry or control, not proof.
a1-us.iotbing.com	35.155.252.83	US	iotbing (Tuya-associated cloud)	443 (HTTPS)	17000 out / 17000 in	TLS/encrypted	looks like telemetry confidence: medium Low volume (~151 bit/s). Indicator: looks like telemetry or control, not proof.
none	15.204.72.48	US	OVH	3478 (STUN/TURN)	4000 out / 4000 in	STUN/TURN	looks like peer-to-peer session setup confidence: high STUN/TURN present. Indicator: peer-to-peer session setup, not proof that media flowed here.
none	8.8.8.8	US	Google	53 (DNS)	200 out / 0 in	TLS/encrypted	looks like telemetry confidence: medium Low volume (~2 bit/s). Indicator: looks like telemetry or control, not proof.

LAN peers (same Wi-Fi, often phone P2P video)

IP	Ports	Bytes	Class
192.0.0.6 special-use / not a real device	63720	3360 out / 0 in	bogon/placeholder

Open ports (LAN)

Port	Service	Product	Risk
23/tcp	telnet	BusyBox telnetd	high