Skip to content

Comment on Newer TP-Link Routers send large volumes of requests to Avira serversparent

Comments

I had/have a Gemini (Android) from Planet Computers. I disabled wifi and forced its network connections through an ethernet adapter that I connected to a mirror port->wireshark and through a proxy after putting in my own root certificates.

My goal was to silence its network activity when I wasn't using it. One by one I removed APKs and blackholed IPs and domains, starting with everything from Google. I was disturbed to discover that, even having nothing installed and everything ripped out that I could, once every week or two while sitting untouched it would phone home to an IP address in China that I failed to connect to any software on the phone and whose IP WHOIS made no sense. I asked Planet Computers about it and they had no idea.

Would like to see this writeup somewhere, both for the results and for the methodology.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.