rinkleff.dev/hy310

Methodology

Lab setup

The projector was isolated on the router's guest Wi-Fi. That network has internet access only: no route to the home LAN, and guest clients are isolated from each other. Packets were captured on the router itself.
topology
the internetFRITZ!Boxrouter + packet capturemain LAN · guest Wi-Ficapture runson the guest APhome devicesnever reachableprojector · HY310guest Wi-Fi, isolatedno route from guestinternet onlyevery packet recorded,then analysed offline

Capture point. The whole thing started because I discovered that FRITZ!Box OS ships with a packet-capture tool built right into the router (the Paketmitschnitt page at http://fritz.box/html/capture.html). It streams a pcap of any interface straight to the browser. Capturing the guest AP interface gives already-decrypted 802.11 data frames, so all of the projector's IP traffic is visible without touching Wi-Fi encryption. No extra hardware, no SPAN port, no mitmproxy.

Session. Factory-fresh connection to the network, then: menus, YouTube, installing Netflix, installing SmartTube, watching a video in it. 747 s total, 191,503 frames kept.

Analysis. tshark dissection, Python decoders for base64/gzip/form payloads, TCP-sequence-span matching of downloads against the store catalog, whois/Team Cymru ASN lookups for remote IPs, and manual cross-checks against public IoC lists.

Limitations

What this capture can and cannot show

Packet loss
The router capture dropped ≈30 % of downstream frames (228.6 MB captured vs ≈332 MB delivered per TCP ACKs). Upstream, meaning what the device sends, is essentially complete. Download sizes in findings are ACK-corrected.
No TLS decryption
For HTTPS we see the destination (SNI/IP), timing and volume, not the content. Baidu and store HTTPS payloads remain opaque.
12.5 minutes
No idle or overnight period. Delayed droppers, hourly/daily beacons or a later SilentSDK push cannot be ruled out.
Attribution
Links to public malware research are based on matching domains, IPs, firmware build and package names, not on code analysis of this unit.

Privacy

A note on the published data

Everything on this site is derived from the capture by script, and anything that could identify me, my home network or this specific unit has been removed first. What stays is only what's useful to understand the device: the servers it talks to, the apps it runs, timings and volumes. The projector's own behaviour is shown in full; nothing about its owner is.