Seeing heavier than average activity all of a sudden from “http://rum-ingest.usO.signalfx.com”, figured out it’s only my moms iPhone (lemmy.nz)

submitted 3 days ago by WYLD_STALLYNS@lemmy.dbzer0.com to c/asklemmy@lemmy.world

25 comments fedilink hide all child comments

Anyone have an ideas on what app(s) could be the culprit? It seems to be regular enough to have it be 469 hits a day! Which is nuts. I would ask her, but as many children of a parent know’s, that’s like pulling teeth lol… But I figured some more tech savvy folks here might actually already have the answer as Reddit and search engines aren’t as reliable these days. 😣 Thanks in advance for any help as I’m stumped to figure it out as she complains about the battery drain incessantly.

top 25 comments

sorted by: hot top new old

[-] Bluetreefrog@lemmy.world -1 points 2 days ago

Rule 5. Locking.

[-] Rhynoplaz@lemmy.world 26 points 3 days ago

If I had to bet, it was probably bundled in with some app she downloaded. There are so many shady games and utility apps that install their own spyware into the phone. It might not even be anything that she uses all that often. Once it's in there, it just does it's own thing in the background.

I'd go through the app list in the settings menu and close and delete any downloaded apps she doesn't use or recognize.

[-] WYLD_STALLYNS@lemmy.dbzer0.com 10 points 2 days ago

This my theory, so I’ll give your suggestion a try tonight. I told her to stick to the Apple Arcade since those seem to remove the tracking to stay listed. It’s not ideal but it’s like parents are like having really old kids haha

[-] TheGoldenGod@lemmy.world 10 points 3 days ago

This is my bet too. But my mom is an airhead and tech conversations with her remind me of that Mom Translator skit from SNL. 😂

[-] trxxruraxvr@lemmy.world 21 points 3 days ago

Looking at signalfx.com it seems to be a platform to spy on app/website users, so could be anything. If your block of the domain does not cause the app to malfunction and her to complain, the only way might be to inspect the traffic. But that might require setting up a mitm attack with forged certificates. You might not want to go that far.

[-] WYLD_STALLYNS@lemmy.dbzer0.com 11 points 2 days ago

Blocked it and she hasn’t complained anything’s broken so far so it’s hard to diagnose at my n00bish skill level. Sadly I don’t know how to set up a mitm attack because it could show the calls. I asked her what she’s doing, she says it’s Facebook. The problem is they continue even when she’s off her phone and I turned almost every Notification off on her phone and she thinks she’s WAYY more savvy than she actually is.

[-] TheGoldenGod@lemmy.world 11 points 3 days ago

It looks like the image is NextDNS, so chances are it’s how he found out what’s causing the drain. Guessing she isn’t seeing any signs of apps not working but its caused noticeable battery issues. 🤔

[-] tal@lemmy.today 11 points 3 days ago

I'm not familiar with iOS, but I assume that it's similar to Android, and you can kill an app.

It looks like you have a counter there, which I assume ticks up for each connection.

Make a list of open apps.

Kill the first half of them.

If the counter stops ticking up, it was in that half. If not, it was in the other.

If it was in the half that you killed, kill the running apps.

Now open half of the "still suspect" list.

Repeat what you did above. Each pass eliminates half of the remaining apps, so you should be able to get it in log₂(N), where N is the number of initially running apps.

[-] WYLD_STALLYNS@lemmy.dbzer0.com 9 points 2 days ago

You’re probably right, I’ll give that a shot tonight. But I think in iOS it’s a feature I have to turn on due to Privacy.

[-] moondoggie@lemmy.world 3 points 2 days ago

I don’t know if it would do anything, especially if it’s a bad actor, but have you tried turning off background refresh under Settings > General? If completely turning it off makes it stop, you can go through tal’s method to figure out the culprit.

[-] felixwhynot@lemmy.world 10 points 3 days ago

If battery life is the issue, start by looking at the drain from each app. Settings > Battery

[-] WYLD_STALLYNS@lemmy.dbzer0.com 10 points 2 days ago

I’ll give this a check too, I have to wait until she gets home and looses interest in her phone to check it out. I want to block Meta altogether considering it’s mostly ads, but she’d probably go through withdrawals 😵‍💫

[-] hexagonwin@lemmy.today 3 points 2 days ago* (last edited 2 days ago)

there's an app called ProxyPin on iOS appstore that kinda works like pcapdroid on android. works as local vpn and lets you see packets from apps. it only seems to work with http(s) though.

btw may i ask what's the software you're using for this dns firewall (or something like that)?

[-] xtools@programming.dev 4 points 2 days ago

not op, but it's nextdns, i'm using it too

[-] hexagonwin@lemmy.today 3 points 2 days ago

thanks

[-] testaccount789@sh.itjust.works 5 points 2 days ago

Sorry, don't have an answer for iPhones, but if someone has similar issue originating from Android device, RethinkDNS app logs could be useful: https://f-droid.org/packages/com.celzero.bravedns/

One interesting app I have right now when it comes to network crap is NetMonster. I blocked its network access, but it keeps making roughly 2.3 DNS requests per second. That's almost 6 million DNS requests per month.
Oh, and when I used NextDNS blockpage, it kept making connections to it, wasting network bandwidth. But that option also revealed to me that many apps which show ads ignore TLS certificates, and just display what gets fed to them.

this post was submitted on 25 Aug 2026

33 points (86.7% liked)

Ask Lemmy

41148 readers

2484 users here now

A Fediverse community for open-ended, thought provoking questions

Rules: (interactive)

1) Be nice and; have fun

Doxxing, trolling, sealioning, racism, toxicity and dog-whistling are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them

2) All posts must end with a '?'

This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?

3) No spam

Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.

4) NSFW is okay, within reason

Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com. NSFW comments should be restricted to posts tagged [NSFW].

5) This is not a support community.

It is not a place for 'how do I?', type questions. If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.

6) No US Politics.

Please don't post about current US Politics. If you need to do this, try !politicaldiscussion@lemmy.world or !uspolitics@lemmy.world

7) No Hit-and-Run questions.

Please don't delete your post for no apparent reason. If you plan on deleting a question later, say so in the post, or if you feel that you have a good reason to remove it, message a mod beforehand. It's not fair to the ones who took their time to answer, and it's not in the spirit of the community.

8) No Bots.

Posts or comments from bots, LLM's, AIs, Neural Networks, Transformers, or Marvin the Paranoid Android are not welcome in AskLemmy. Real humans only please.

Reminder: The terms of service apply here too.