A Russian phone number, WhatsApp, and 140 outbound SSH alerts
2 days ago
- IDS alerts for SSH scans from an iPhone were actually caused by WhatsApp's connection race behavior, not malicious activity.
- The author initially misinterpreted the IDS rule, which triggers on a threshold of 5 SYNs in 2 minutes, not on individual connections.
- Controlled packet capture showed that launching WhatsApp triggers a burst of 10-24 parallel connections to various servers, which are abandoned once the normal connection succeeds.
- The phone had a Russian number, and the behavior is theorized to be a censorship circumvention feature embedded in WhatsApp for users in blocked regions.
- No evidence of compromise was found; the device checks were clean, and the traffic was minimal and associated only with WhatsApp launches.
- Lessons learned: read detection rules carefully, check all devices for the same behavior, establish an idle baseline, run controlled tests, and capture traffic before building theories on sampled logs.