Hi
ive been monitoring my home network and have found something unusual. My iPad Air 2 keeps trying to contact an IP(49.234.241.239) address in China.
i have cleared the safari settings/cache, rebooted and no apps are running. Yet every time my iPad connects it tries to contact stated IP.
That article suggests if your iPad was set to China as the region (check Settings > General > Language & Region).
It also tells you how to turn it off (Settings > Safari > Fraudulent Website Warning).
Does changing any of those settings make a difference? Are there any additional languages or keyboards set up other than English?
If not, you may want to try a full iTunes restore - setup as a new iPad when asked and do not restore from backup or sign into iCloud. Then check for a day or so and see if it still does it.
That would help confirm if there's an issue with iOS or with an app somewhere.
Hi
after a bit of research I found that Apple use Tencent to check for fraudulent sites if iOS device is based in China and google for elsewhere. Toggling the option in safari seems to fix the issue for a couple of hours, but then it returns.
another strange behaviour.... safari in private mode, a pop up was able to still work outside of the safari app and double tapping the home button was disabled at the same time. Couldn’t get to anything as the pop up would clear until I hit cancel.
Yes that’s the same info I got researching it, but I have none of those apps installed 🤔 I’m the only user of the iPad too.
the iPad makes no attempt to lookup that IP... it looks hard coded.
DNS server has no record of the iPad looking this address up. My firewall is also setup to block Chinese addresses. It looks like the IP is hard coded. It’s only been happening since the 29th.
i have geo ip filtering on my firewall which blocks address in China. I’m also using DNS to block Chinese addresses.
so although my iPad and iPhone are trying to contact the above IP, they are being blocked.
Might be related to this....
Although I’m based in UK.
Apple moderators please advise?
If it keeps happening, I will have to assume iOS is compromised 😔
Safari is not the only application that goes onto the internet. In this case, a reverse DNS suggests that IP address belongs to Tencent - a big app developer in China.
In other words, you or someone who has access to your iPad plays PUBG on your iPad or you use QQ/WeChat.
also the certificate to that IP is showing as fraudulent website.
iPad constantly trying to contact China IP address.
