News for hackers. Stuff that matters.
Re:Alarming number of DNS requests made by iOS devices by stanlarroque on Saturday October 21, 2017 @09:43PM (#15524675)
UPDATE: I updated my article with a more recent graph with more devices connected.

Here is a quick CSV export of all the concerned hosts (subdomain + domain) I could pick from my database.

https://stan.sh/images/ios_domains.csv

I really want the story behind pancake.g.aaplimg.com

Re:Alarming number of DNS requests made by iOS devices by kirb on Sunday October 22, 2017 @03:15AM (#15525582)
Some quick explanations of non-obvious ones:

mesu, su: software update

pancake: looks like home sharing? https://stackoverflow.com/questions/26900625/what-is-pancake...

phobos, mzstatic: App/iTunes store, possibly also Apple Music

apptrailers: App Store app demo videos?

streamingaudio: Apple Music?

iphonesubmissions, radarsubmissions: crash report upload

guzzoni: Siri

appldwnld: firmware downloads

gs: firmware signature generator/verifier

albert: device activation

ckdatabase, ckdevice: CloudKit, like iCloud 2.0

keyvalueservice: old iCloud sync service, still used with text shortcuts sync

fmf: Find My Friends

fmip: Find My iPhone

All in all just looks normal, there's a lot of features in iOS/macOS/iTunes etc etc and they all have their own respective hostnames, possibly many for old school random-hostname-based load balancing, etc. Seems pretty normal that your users would be downloading apps (or the phone downloading updates automatically), playing Apple Music, updating iOS, etc. Spammy, but not that big a deal. I'd imagine rather similar from Android by filtering to Google, Samsung, etc hosts.

Re:Alarming number of DNS requests made by iOS devices by natch on Sunday October 22, 2017 @12:11AM (#15525119)
Yes it’s a cloud connected device, it is going to connect to the cloud. I don’t see why you are surprised.

If you think there is an issue, instead of breathlessly declaring you’ve discovered a disturbing pattern in a system you couldn’t possibly have an informed perspective on, the correct way to handle it is to file a radar at https://bugreport.apple.com/ then come back here tell us your radar number so we can dupe it and add any of our own data that might help with the (perceived, in this case, I would say) issue.