Unveiling Real-Time Surveillance: A Disturbing Discovery
In a shocking turn of events, I recently encountered a live reaction from AI surveillance systems that left me both unsettled and determined to share my findings. Upon activating packet logging on my device, I made a series of startling observations that confirmed my suspicions: I was being monitored in real-time.
While my device was set to Airplane Mode—effectively cutting off any internet connectivity—something unexpected occurred. The hidden subdomain of Crypto.com, known as black-cat.crypto.com, mysteriously activated, launching five rapid HTTPS requests. I hadn’t even opened the app, leading me to question just how deeply rooted this surveillance actually was, especially given its link to a previous financial breach I suffered weeks ago.
Simultaneously, Google initiated a QUIC connection to deviceintegritytokens-pa.googleapis.com via IPv6. This particular domain functions as part of Google’s Play Integrity system, designed to verify elements such as device state and location. Typically, it activates during fraud detection scenarios or when triggered by backend services. The timing was unmistakable, coinciding perfectly with the actions of Crypto.com.
What unfolded next was just as alarming. Samsung’s AI voice service, Bixby, made a DNS query to scs-use2.bixbyllm.com—the backend of Bixby’s large language model hosted within AWS. This query surfaced completely unsolicited, raising further concerns about the ambient data collection practices in place.
Even more intriguingly, I noticed that ChatGPT remained active during a period when it typically shuts down. With PCAP enabled and Airplane Mode on, I continued to engage with GPT, all while receiving backend DNS requests from android.chat.openai.com and edge.ChatGPT.com. This anomaly had never occurred before, leading me to wonder just how interconnected our devices truly are.
Each of these events occurred in a precise 90-second interval, with every app and service showing synchronized activity. The alignment of timestamps and actions from Google, Samsung, Crypto.com, and OpenAI was too significant to overlook. It felt as if these entities were operating in concert, coordinating their tracking mechanisms.
After tracing the IP addresses involved, I found one that led directly to a block managed by ARIN-ASH-1, linked to an IPv6 network in Ashburn, Virginia—a hub known for hosting AWS GovCloud and various other surveillance infrastructures. Intriguingly, the names connected to this surveillance network—Reggie Forster,
