iPhone pinging mask.icloud.com with Private Relay turned off

Implement3443 · Jun 27, 2024

Does anyone know why iPhone ping mask.icloud.com and mask-h2.icloud.com even with Private Relay, Private Wi-Fi address, and Limit IP Address Tracking turned off? What could be causing it?

DJones · Jun 27, 2024

Implement3443 said:
Does anyone know why iPhone ping mask.icloud.com and mask-h2.icloud.com even with Private Relay, Private Wi-Fi address, and Limit IP Address Tracking turned off? What could be causing it?

Is this turned on in mail?

Implement3443 · Jun 27, 2024

DJones said:
View attachment 59821
Is this turned on in mail?

Yes! This might be it, I will test and report back.

Difides · Jun 27, 2024

I have these domains blocked.. it's a bypass method and tracking at the same time

DJones · Jun 27, 2024

Difides said:
I have these domains blocked.. it's a bypass method and tracking at the same time

I can’t say if it’s a tracking method utilized by apple or not.

But I can say for sure loading any email locally directly to your phone IS a tracking method for people that sent the email.

How it might work below is speculative.

Photos even pixel size photos that load a picture to your phone from a remote server track your email is alive, and your ip address, and probably other information. They can track generally or uniquely by the photo having a unique url referenced to your email.

So by masking your ip address it does provide some security through obscurity.

Does that mean masked loading remote images won’t confirm to them your email is alive. Unlikely if it load an image that’s probably enough for them to hit you with waves of junk mail.

Tech9 · Jun 27, 2024

DJones said:
But I can say for sure loading any email locally directly to your phone IS a tracking method for people that sent the email.

And how accessing a picture somewhere from an unknown IP address is associated to my particular Gmail, for example?

Difides said:
it's a bypass method and tracking at the same time

No, it's a secure DNS with tracking prevention available for whoever wants to use it.

DJones · Jun 27, 2024

Tech9 said:
And how accessing a picture somewhere from an unknown IP address is associated to my particular Gmail, for example?

No, it's a secure DNS with tracking prevention available for whoever wants to use it.

Again speculation I don’t assert this as fact.

In this scenario you’re using pop3 or imap to sync your mail to your phone or computer. And you don’t use a vpn obsessively or cellular or a method of masking your ip. It could give port scanners a better target then casting a wide net.

Could remote loading of any photo or pixel tracking be done with any ad tracking to obtain your ip on any website sure.

If you generate unique urls for the tracking pixel or photos that are associated with that email in a database once the photo is loaded and a request is made of the server with that unique url they should be able to log the requested ip.

If you’re on a cellphone using cellular and not wifi it really shouldn’t matter because the ip address should change frequently. But from ISP’s that have really long lived ip addressing that’s where I think it might be beneficial for phishing.

The email being useful could come down to your password being known from past leaks, and commonly reused if they find a way into your system.

How they get into your system really isn’t the point. Could be malware, known application vulnerability’s, social engineering. But it would sure help if they knew your administrator password and could escalate any software they want to ring 0 kernel.

Really my point is it’s gathered information tying you to your network/system, to your email, and your passwords. individual links in the chain may not be useful immediately, but multiple weak links might.

Difides · Jun 28, 2024

Tech9 said:
And how accessing a picture somewhere from an unknown IP address is associated to my particular Gmail, for example?

No, it's a secure DNS with tracking prevention available for whoever wants to use it.

so again .. it is a bypass of your DNS .. and there is no easier method to track internet movement than snooping dns ..

Tech9 · Jun 28, 2024

Difides said:
it is a bypass of your DNS

It's a secure DNS bypassing any other DNS including yours. This is what it was designed to do. It's an optional paid service part of iCloud+ subscription. To track your "internet movement" just don't use iCloud Private Relay. To track your own devices on your network don't use Private Wi-Fi Address. So first - you have to know what do you want. No one is working against your preferences or settings.

Tech9 · Jun 28, 2024

Difides said:
ne, dotazy na tyto dns jsou i ve vypnutém stavu a je to bez souhlasu uživatele nebo jakéhokoli vědomí

Not used for DNS resolution though. Your Asus router is contacting Microsoft domain all the time, no?

Difides · Jun 28, 2024