Solved - Wzye V3 cam... Any ideas to figure out why an outside IP attempting connections to two ports keeps following me?

Mike A.

Mike A.

Known around here
May 6, 2017
4,199
7,066
An outside IP address (45.35.33.242) continually attempts connections to ports to 53204 and 58382. I can force a change to my external IP address and within a minute or so the attempts will follow. So I assume that I must have something that's beaconing out to report the change.

The IP is not associated with anything known to me. Whois info is below. By geolocation, server appears to be physically located in either Dallas Texas
or Bangladesh depending on which lookup service used..

IP Location Bangladesh Bangladesh Dhaka Mellowhost
ASN Bangladesh AS40676 AS40676, US (registered Feb 26, 2008)
Resolve Host esx1.fazey.org
Whois Server whois.arin.net
IP Address 45.35.33.242
NetRange: 45.34.0.0 - 45.35.255.255
CIDR: 45.34.0.0/15
NetName: PSYCHZ-NETWORKS
NetHandle: NET-45-34-0-0-1
Parent: NET45 (NET-45-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS40676
Organization: Psychz Networks (PS-184)
RegDate: 2015-03-03
Updated: 2015-03-03
Ref:
OrgName: Psychz Networks
OrgId: PS-184
Address: 20687-2 Amar Road #312
City: Walnut
StateProv: CA
PostalCode: 91789
Country: US
RegDate: 2013-04-17
Updated: 2013-09-05
Ref:
ReferralServer: rwhois:/rwhois.psychz.net:4321

OrgTechHandle: NOC3077-ARIN
OrgTechName: NOC
OrgTechPhone: +1-626-549-2801
OrgTechEmail:
OrgTechRef:
OrgAbuseHandle: NOC3077-ARIN
OrgAbuseName: NOC
OrgAbusePhone: +1-626-549-2801
OrgAbuseEmail:
OrgAbuseRef:
NetRange: 45.35.33.0 - 45.35.33.255
CIDR: 45.35.33.0/24
NetName: PSYCHZ-NETWORKS
NetHandle: NET-45-35-33-0-1
Parent: PSYCHZ-NETWORKS (NET-45-34-0-0-1)
NetType: Reallocated
OriginAS: AS40676
Organization: Psychz Networks Dallas (PND-24)
RegDate: 2015-08-21
Updated: 2015-08-21
Ref:
OrgName: Psychz Networks Dallas
OrgId: PND-24
Address: 1515 Round Table Drive
City: Dallas
StateProv: TX
PostalCode: 75247
Country: US
RegDate: 2015-08-21
Updated: 2015-08-21
Ref:
OrgTechHandle: TEXAS1-ARIN
OrgTechName: Texas - NOC
OrgTechPhone: +1-626-549-2801
OrgTechEmail:
OrgTechRef:
OrgAbuseHandle: TEXAS1-ARIN
OrgAbuseName: Texas - NOC
OrgAbusePhone: +1-626-549-2801
OrgAbuseEmail:
OrgAbuseRef:
NetRange: 45.35.33.224 - 45.35.33.255
CIDR: 45.35.33.224/27
NetName: PSYCHZ-NETWORKS
NetHandle: NET-45-35-33-224-1
Parent: PSYCHZ-NETWORKS (NET-45-35-33-0-1)
NetType: Reassigned
OriginAS: AS40676
Organization: Mellowhost (MELLO-3)
RegDate: 2016-03-09
Updated: 2016-03-09
Ref:
OrgName: Mellowhost
OrgId: MELLO-3
Address: 174/A Lane 2 Apt 1B
Address: Baridhara DOHS
City: Dhaka
StateProv: DHAKA
PostalCode: 1206
Country: BD
RegDate: 2016-02-21
Updated: 2016-02-21
Ref:
OrgTechHandle: SHS18-ARIN
OrgTechName: Shayan, Surid Halder
OrgTechPhone: +8801713123262
OrgTechEmail:
OrgTechRef:
OrgAbuseHandle: SHS18-ARIN
OrgAbuseName: Shayan, Surid Halder
OrgAbusePhone: +8801713123262
OrgAbuseEmail:
OrgAbuseRef:
Click to expand...

Looks to be at a small hosting company. The host system noted at that IP appears to be an abandoned blog site for fazey.org. Looking up that domain directly now resolves to AWS (as mentioned in the guy's About section). So again, not something big and known that anything I have should be connecting to.

Unfortunately I have a ton of stuff on my network so hard to narrow things down much by turning things off. I've pulled the single cable connecting my internal network to my router and the attempts continue. I've not yet tried pulling the plug and then attempting to release/renew my IP.

I've run Wireshark to watch for anything calling out to that IP/hostname directly but don't see anything. Could be connecting to some other system to report I suppose.

I have no open ports at my router. VPN in only.

The connection attempts are blocked so not that big of a deal. Just curious why the damn thing keeps tracking me.
 
Last edited:
  • Like
Reactions: mat200 and Flintstone61
Ahhh... found it!

It's from two Wyze V3 cams. WiFi traffic didn't show in Wireshark.

udp 192.168.2.189:58382 45.35.33.242:10001 UNREPLIED
udp 192.168.2.238:53204 45.35.33.242:10001 UNREPLIED

Now the question is WTF are my Wyze cams doing connecting to that host?

I'll ask on Wyze's forums. At least I know what it is now.
 
  • Like
  • Haha
Reactions: CCTVCam, SouthernYankee, mat200 and 1 other person
Mike A. said:
Ahhh... found it!

It's from two Wyze V3 cams. WiFi traffic didn't show in Wireshark.

udp 192.168.2.189:58382 45.35.33.242:10001 UNREPLIED
udp 192.168.2.238:53204 45.35.33.242:10001 UNREPLIED

Now the question is WTF are my Wyze cams doing connecting to that host?

I'll ask on Wyze's forums. At least I know what it is now.
Click to expand...
So they are "phoning home" but it sounds like you are blocking the return traffic.
 
  • Like
Reactions: mat200
SpacemanSpiff said:
Is your cam network not isolated from the wubwubwub?
Click to expand...

Everything else is but not those two Wyze V3 cams that I picked up to play with. They need to get out in order to work. They were on a separate WiFi network but I moved them back over when trying the new RTSP beta to connect to BI. Have to look to better lock them down again now.
 
  • Like
  • Haha
Reactions: mat200 and user8963
Mike A. said:
Now the question is WTF are my Wyze cams doing connecting to that host?
Click to expand...

If I am not mistaken, they're designed to work with the cloud, which allows one to view their live feed. Reports say they can be set to work without the Internet
 
mikeynags said:
So they are "phoning home" but it sounds like you are blocking the return traffic.
Click to expand...

Yes. Apparently it's related to their P2P service. They contract out that service and I suppose that the company that runs it likely picked up that IP at some point. Looking more closely once I found what it was I see a bunch of similar threads re their cams connecting in the same way to odd servers. Seems that blocking the incoming doesn't affect whatever operation. Not sure what the purpose of those ports is and why they'd expect that they'd ever be open. Maybe they try UPnP to open them which would be blocked on my network. They obviously tunnel in other ways also since they still work inside/outside my network.

Got just to mess around with since I found them cheap on clearance at Home Depot for $15 including the SD card. The color night pictures looked good in what I'd seen. In use I'm not all that impressed. Indoors at night they look great. In a more complex scene outdoors the compression that they use causes the image to degrade greatly (threads on that as well looking more). Starts breaking down to the point that the pixelation will trigger motion alerts in BI. ; ) (Example below.) I'm even less impressed now with the connection to some strange server but I suppose I knew that was happening in some form.


wyzev3motionartifacts-jpg.103613
 
Last edited:
  • Like
Reactions: mat200
SpacemanSpiff said:
If I am not mistaken, they're designed to work with the cloud, which allows one to view their live feed. Reports say they can be set to work without the Internet
Click to expand...

Yes, cloud-based cams. Not sure to what extent they'll work without Internet. They need the app to control them and the AI-based detection functions also are cloud-based. According to some posts in the beta forums when people have tried to block them, they need to connect when they first start up or they'll begin to disconnect every 4 or 5 minutes. Now that they have the RTSP beta on them and they're all set up in BI I'll play with them more to find out.
 
  • Like
Reactions: mat200
Did a quick test to see what would happen if blocked. Kind of as expected.
  • The attempted outside connection does stop since no call out on port 10001.
  • The app does not work since it can't reach the cam. No big deal once set up in BI other than if you need to change something. Can use BI to view locally/remotely.
  • AI motion detection doesn't work since cloud-based.
  • Cam does briefly drop off about every 5 minutes. Not that big of a deal since it's a very quick drop and immediate reconnect. You would not notice unless looking at it at the time or on the BI status page.
 
  • Like
Reactions: CCTVCam and mat200
Mike A. said:
Did a quick test to see what would happen if blocked. Kind of as expected.
  • The attempted outside connection does stop since no call out on port 10001.
  • The app does not work since it can't reach the cam. No big deal once set up in BI other than if you need to change something. Can use BI to view locally/remotely.
  • AI motion detection doesn't work since cloud-based.
  • Cam does briefly drop off about every 5 minutes. Not that big of a deal since it's a very quick drop and immediate reconnect. You would not notice unless looking at it at the time or on the BI status page.
Click to expand...

Thank you for this insight and valuable information as it relates to this problem. Along with testing out the RTSP firmware for me and others!

I purchased this camera for the soul purpose as a throw away and used on a dedicated isolated network. I’m not concerned about someone being able to watch a bird nest in a eve trough or my sump pump in the pitch black!
 
  • Like
Reactions: CCTVCam and mat200
Thanks @Mike A.

Always enjoy seeing good info posted

definitely keep us informed on what you learn.
 
Another issue noticed with blocking the Wyze cams - time.

The cam now has no way to get the correct time and I see no way to select some alternative time server.

Since I posted above a little more than 24 hours ago, it's already about 1/2 hour behind actual time.
 
  • Haha
Reactions: user8963
Mike A. said:
Another issue noticed with blocking the Wyze cams - time.

The cam now has no way to get the correct time and I see no way to select some alternative time server.

Since I posted above a little more than 24 hours ago, it's already about 1/2 hour behind actual time.
Click to expand...

That’s pretty disheartening to learn given modern elections now in place. I guess none of us should be too surprised the camera doesn’t incorporate a RTC.

I would have thought this camera would lose maybe on the extreme end of the scale from maybe 1-3 seconds per day.

Not 30 minutes?!?
 
Seems to have stayed at about 1/2 hour since I posted.

I pulled the plug on it now and on restart it comes up about 12 hours behind showing yesterday's date. i.e., 27 minutes after midnight 10/13/2021

I think it might be that it wasn't losing time. Maybe it just started up that far behind and I didn't notice then.

No idea where it's coming up with the time/date shown.

I'll unblock it and let it do whatever it does when drops offline at the next 5 minute interval and see if it grabs the right time again.

Edit to add... Didn't have to wait long. Pulls the right time after the usual drop-off as I thought that it probably would. I blocked it again and now have a good reference time. See how well it stays on time from here.
 
Mike A. said:
Seems to have stayed at about 1/2 hour since I posted.

I pulled the plug on it now and on restart it comes up about 12 hours behind showing yesterday's date. i.e., 27 minutes after midnight 10/13/2021

I think it might be that it wasn't losing time. Maybe it just started up that far behind and I didn't notice then.

No idea where it's coming up with the time/date shown.

I'll unblock it and let it do whatever it does when drops offline at the next 5 minute interval and see if it grabs the right time again.
Click to expand...

I also agree that this camera should offer the ability to point to a NTP Server whether local first vs cloud first.
 
It was doing so well for most of the day. I was about to post that it had stayed on time since I let it get out and get the time.

But then I go look now and it says that it's 14:22 when it's actually 22:43.

Not sure when it lost it but whenever it did, it did in a big way.
 
Yes, I could. Don't really care in this case. Not a critical cam just something to play around with and reporting what I've found. Have plenty of others to capture things.

You can turn off the time display in the Wyze app so that wouldn't be a problem if someone wanted to.

Thanks for the link. Reading through it I learned that the overlays no longer increase overhead quite a bit like they did. Didn't realize that had changed.
 
You must log in or register to reply here.
Top Bottom