https://nox.sh/tags/ids/ Recent content in Ids on nox.sh Hugo en-us Mon, 27 Jul 2026 10:00:00 +0000 https://nox.sh/posts/whatsapp-tunnel-out/ Mon, 27 Jul 2026 10:00:00 +0000 https://nox.sh/posts/whatsapp-tunnel-out/ <p>For about five weeks, my UDM Pro kept generating the same alert from one iPhone on my network:</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>ET SCAN Potential SSH Scan OUTBOUND </span></span><span style="display:flex;"><span>source: [iPhone on local VLAN] </span></span><span style="display:flex;"><span>destination: [redacted cloud host]:22/tcp </span></span></code></pre></div><p>I had 140 of these. No other device on the network generated one.</p> <p>My setup is nothing unusual: a UDM Pro at the edge, with Pi-hole and Unbound handling DNS.</p> <p>I took the alert name literally. One phone appeared to be opening SSH connections to cloud servers around the world, sometimes at 3am. I checked for unknown profiles, certificates, VPNs and linked devices. I found nothing and got close to recommending a wipe.</p>