{"items":[{"id":"01M6MYEEW5Y6690ZV4VC2Z68GS","slug":"hak5-mg-o-mg-cable","vendor":"Hak5 / MG","oem":null,"model":"O.MG Cable","hw_revision":null,"category":"usb_cable","country_of_origin":"US","description":"A USB cable with a hidden Wi-Fi-enabled implant that can act as a keyboard, log keystrokes and exfiltrate over Wi-Fi. Sold openly as a penetration-testing tool; listed here as the category exemplar for what a malicious cable looks like on the wire.","status":"confirmed","status_reason":"Vendor-documented behaviour; sold as a security-testing tool. Category exemplar.","status_at":1793853876243,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851865989,"updated_at":1793853876243,"url":"https://isitspying.com/p/hak5-mg-o-mg-cable"},{"id":"01M6MYEE21Y7FECRE2V6JRJQ2B","slug":"bosch-drivelog-connect-obd-ii-dongle","vendor":"Bosch","oem":null,"model":"Drivelog Connect OBD-II dongle","hw_revision":null,"category":"obd_dongle","country_of_origin":"DE","description":"Bluetooth OBD dongle. Argus Cyber Security (2017) showed the pairing PIN could be brute-forced and messages injected onto the CAN bus (CVE-2017-9663, CVE-2017-9664).","status":"confirmed","status_reason":"Argus disclosure, April 2017; patched","status_at":1793853875942,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851865153,"updated_at":1793853875942,"url":"https://isitspying.com/p/bosch-drivelog-connect-obd-ii-dongle"},{"id":"01M6MYED9B67BCKH82Q1PVHAJX","slug":"d-link-dir-859","vendor":"D-Link","oem":null,"model":"DIR-859","hw_revision":null,"category":"router","country_of_origin":"CN","description":"End-of-life router with a path traversal exposing credentials (CVE-2024-0769); exploited in the wild per CISA KEV, no patch planned.","status":"confirmed","status_reason":"CVE-2024-0769 (CISA KEV); vendor: end of life","status_at":1793853875610,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851864363,"updated_at":1793853875610,"url":"https://isitspying.com/p/d-link-dir-859"},{"id":"01M6MYECFGYY9X8A5665VCN740","slug":"tp-link-archer-ax21-ax1800","vendor":"TP-Link","oem":null,"model":"Archer AX21 (AX1800)","hw_revision":null,"category":"router","country_of_origin":"CN","description":"Wi-Fi 6 router with an unauthenticated command injection in the web UI (CVE-2023-1389), exploited by Mirai variants; in CISA's KEV catalog.","status":"confirmed","status_reason":"CVE-2023-1389 (CISA KEV); patched","status_at":1793853875304,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851863536,"updated_at":1793853875304,"url":"https://isitspying.com/p/tp-link-archer-ax21-ax1800"},{"id":"01M6MYEBMPDVRWW36T7KZ1Y5PR","slug":"belkin-wemo-mini-smart-plug-f7c063","vendor":"Belkin","oem":null,"model":"Wemo Mini Smart Plug F7C063","hw_revision":null,"category":"smart_plug","country_of_origin":"CN","description":"Second-generation Wemo Mini. Sternum (2023) found a buffer overflow via the device name field (CVE-2023-27217); Belkin said the model is end-of-life and will not be patched.","status":"confirmed","status_reason":"CVE-2023-27217; vendor declined to patch (EOL)","status_at":1793853874976,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851862678,"updated_at":1793853874976,"url":"https://isitspying.com/p/belkin-wemo-mini-smart-plug-f7c063"},{"id":"01M6MYEASJTCYD9PBQC0EBCGH0","slug":"ecovacs-deebot-x2-omni","vendor":"Ecovacs","oem":null,"model":"Deebot X2 Omni","hw_revision":null,"category":"robot_vacuum","country_of_origin":"CN","description":"Flagship robot vacuum with camera and microphone. Researchers Dennis Giese and Braelynn (DEF CON 32, 2024) demonstrated Bluetooth-based takeover enabling remote camera and microphone access.","status":"confirmed","status_reason":"DEF CON 32 research (2024); vendor acknowledged and patched","status_at":1793853874650,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851861810,"updated_at":1793853874650,"url":"https://isitspying.com/p/ecovacs-deebot-x2-omni"},{"id":"01M6MYEA01PSH38SCYPT4ZAYVW","slug":"xplora-x4","vendor":"Xplora","oem":null,"model":"X4","hw_revision":null,"category":"wearable","country_of_origin":"CN","description":"Children's smartwatch. mnemonic (2020) found a remotely activatable 'Persistent Connection Service' from Qihoo 360 in the firmware that could capture location, audio and photos via SMS commands.","status":"confirmed","status_reason":"mnemonic disclosure, Oct 2020; vendor patched","status_at":1793853874320,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851860993,"updated_at":1793853874320,"url":"https://isitspying.com/p/xplora-x4"},{"id":"01M6MYE996EX1F2HWKKCK4F82G","slug":"enox-safe-kid-one","vendor":"Enox","oem":null,"model":"Safe-Kid-One","hw_revision":null,"category":"wearable","country_of_origin":"CN","description":"Children's GPS smartwatch recalled EU-wide in 2019 (RAPEX A12/0157/19): unencrypted server communication allowed location tracking and calls to the child.","status":"confirmed","status_reason":"EU Safety Gate recall, Feb 2019","status_at":1793853874020,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851860262,"updated_at":1793853874020,"url":"https://isitspying.com/p/enox-safe-kid-one"},{"id":"01M6MYE8FTAQP6W3ARMNGG2Y47","slug":"hasbro-furby-connect","vendor":"Hasbro","oem":null,"model":"Furby Connect","hw_revision":null,"category":"toy","country_of_origin":"CN","description":"Bluetooth-connected Furby. Which? / Context IS (2017) showed that anyone in range could connect without authentication and push audio to the toy.","status":"confirmed","status_reason":"Which? / Context Information Security, Nov 2017","status_at":1793853873762,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851859450,"updated_at":1793853873762,"url":"https://isitspying.com/p/hasbro-furby-connect"},{"id":"01M6MYE7PCEH8467CB8JEDD2H1","slug":"genesis-toys-i-que-intelligent-robot","vendor":"Genesis Toys","oem":null,"model":"i-Que Intelligent Robot","hw_revision":null,"category":"toy","country_of_origin":"CN","description":"Companion robot to Cayla using the same unauthenticated Bluetooth audio design (Norwegian Consumer Council #ToyFail, 2016).","status":"confirmed","status_reason":"Norwegian Consumer Council #ToyFail report, Dec 2016","status_at":1793853873466,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851858636,"updated_at":1793853873466,"url":"https://isitspying.com/p/genesis-toys-i-que-intelligent-robot"},{"id":"01M6MYE6XAG39V4WJD6F7Q4B04","slug":"spiral-toys-cloudpets","vendor":"Spiral Toys","oem":null,"model":"CloudPets","hw_revision":null,"category":"toy","country_of_origin":"CN","description":"Plush toys that recorded voice messages to the cloud. In 2017 the backing database and 2 million recordings were found exposed on the internet; Bluetooth pairing was unauthenticated.","status":"confirmed","status_reason":"Public database exposure documented by Troy Hunt, Feb 2017","status_at":1793853873164,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851857834,"updated_at":1793853873164,"url":"https://isitspying.com/p/spiral-toys-cloudpets"},{"id":"01M6MYE62V9WWRGW7DK73H8DEW","slug":"genesis-toys-my-friend-cayla","vendor":"Genesis Toys","oem":null,"model":"My Friend Cayla","hw_revision":null,"category":"toy","country_of_origin":"CN","description":"Internet-connected doll with an open Bluetooth microphone. Banned in Germany in 2017 as a concealed surveillance device; subject of complaints in the US and Norway.","status":"confirmed","status_reason":"Banned by Germany's Bundesnetzagentur, Feb 2017","status_at":1793853872868,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851856987,"updated_at":1793853872868,"url":"https://isitspying.com/p/genesis-toys-my-friend-cayla"},{"id":"01M6MYE5C1C0SCDK83XRA7KBAN","slug":"ibaby-monitor-m6s","vendor":"iBaby","oem":null,"model":"Monitor M6S","hw_revision":null,"category":"baby_monitor","country_of_origin":"CN","description":"Wi-Fi baby monitor. Bitdefender (2020) reported that cloud credentials in the app allowed access to other users' recordings and device data.","status":"confirmed","status_reason":"Bitdefender Labs disclosure, Feb 2020","status_at":1793853872535,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851856257,"updated_at":1793853872535,"url":"https://isitspying.com/p/ibaby-monitor-m6s"},{"id":"01M6MYE4KZFVCVN5PRBKXPYJQ0","slug":"eufy-anker-eufycam-2-video-doorbell-2022-cloud-upload","vendor":"eufy (Anker)","oem":null,"model":"eufyCam 2 / Video Doorbell (2022 cloud upload)","hw_revision":null,"category":"ip_camera","country_of_origin":"CN","description":"Cameras marketed as local-only storage. In late 2022 researchers showed thumbnails and, via the web portal, streams were reachable through Anker's cloud; Anker later acknowledged and changed the behaviour.","status":"confirmed","status_reason":"Vendor acknowledged the cloud uploads and portal access (The Verge, Feb 2023)","status_at":1793853872263,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851855487,"updated_at":1793853872263,"url":"https://isitspying.com/p/eufy-anker-eufycam-2-video-doorbell-2022-cloud-upload"},{"id":"01M6MYE3NRN9DYBECKW2DJ55YW","slug":"xmeye-based-cameras-and-nvrs","vendor":null,"oem":"Hangzhou Xiongmai Technology","model":"XMEye-based cameras and NVRs","hw_revision":null,"category":"ip_camera","country_of_origin":"CN","description":"White-label cameras/DVRs built on Xiongmai boards using the XMEye P2P cloud. SEC Consult (2018) found default admin credentials, predictable cloud IDs and an unsigned firmware update path.","status":"confirmed","status_reason":"SEC Consult disclosure and ICS-CERT advisory, Oct 2018","status_at":1793853871964,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851854520,"updated_at":1793853871964,"url":"https://isitspying.com/p/xmeye-based-cameras-and-nvrs"},{"id":"01M6MYE2V5VRX38NPB05X6GZ5K","slug":"tp-link-tapo-c200","vendor":"TP-Link","oem":null,"model":"Tapo C200","hw_revision":null,"category":"ip_camera","country_of_origin":"CN","description":"Popular budget pan-tilt camera; firmware before 1.1.16 had an unauthenticated remote code execution flaw (CVE-2021-4045).","status":"confirmed","status_reason":"CVE-2021-4045; patched by TP-Link","status_at":1793853871563,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851853669,"updated_at":1793853871563,"url":"https://isitspying.com/p/tp-link-tapo-c200"},{"id":"01M6MYE22E5AJJJWHZ7QX4XFS0","slug":"reolink-e1-zoom","vendor":"Reolink","oem":null,"model":"E1 Zoom","hw_revision":null,"category":"ip_camera","country_of_origin":"CN","description":"Pan-tilt indoor camera with an information-disclosure flaw in its web interface (CVE-2021-40150) in firmware before 3.0.0.716.","status":"confirmed","status_reason":"CVE-2021-40150; fixed in later firmware","status_at":1793853871214,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851852878,"updated_at":1793853871214,"url":"https://isitspying.com/p/reolink-e1-zoom"},{"id":"01M6MYE19YR16XYG0F23ENREDS","slug":"guardzilla-gz501w","vendor":"Guardzilla","oem":null,"model":"GZ501W","hw_revision":null,"category":"ip_camera","country_of_origin":"CN","description":"Indoor security camera whose firmware embedded a shared, hard-coded Amazon S3 credential giving access to all users' stored video (CVE-2018-5560).","status":"confirmed","status_reason":"CVE-2018-5560 (Rapid7 / 0DayAllDay disclosure, Dec 2018)","status_at":1793853870909,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851852094,"updated_at":1793853870909,"url":"https://isitspying.com/p/guardzilla-gz501w"},{"id":"01M6MYE0CP8HJ6Y504NM6FWBZB","slug":"yi-technology-yi-home-camera-27us","vendor":"Yi Technology","oem":null,"model":"Yi Home Camera 27US","hw_revision":null,"category":"ip_camera","country_of_origin":"CN","description":"Home camera in which Cisco Talos found multiple vulnerabilities in 2018, including code execution via crafted network traffic and the companion app.","status":"confirmed","status_reason":"Cisco Talos disclosure, October 2018","status_at":1793853870608,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851851158,"updated_at":1793853870608,"url":"https://isitspying.com/p/yi-technology-yi-home-camera-27us"},{"id":"01M6MYDZG6V768X00XBMZHZRRW","slug":"wyze-cam-v1","vendor":"Wyze","oem":null,"model":"Cam v1","hw_revision":null,"category":"ip_camera","country_of_origin":"CN","description":"First-generation Wyze Cam. Bitdefender disclosed an authentication bypass and a remote-code-execution flaw in 2022; v1 was never patched and reached end of life.","status":"confirmed","status_reason":"Bitdefender disclosure (2022); vendor did not patch v1","status_at":1793853870240,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851850246,"updated_at":1793853870240,"url":"https://isitspying.com/p/wyze-cam-v1"},{"id":"01M6MYDYZ6936RV21MMK4YEMN7","slug":"dahua-ipc-hx-nvr-series-cve-2021-33044-affected-firmware","vendor":"Dahua","oem":null,"model":"IPC-HX / NVR series (CVE-2021-33044 affected firmware)","hw_revision":null,"category":"ip_camera","country_of_origin":"CN","description":"Dahua cameras and recorders with an authentication bypass in the loopback/NetKeyboard login flow.","status":"confirmed","status_reason":"CVE-2021-33044 / CVE-2021-33045 (CISA KEV)","status_at":1793853869870,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851849702,"updated_at":1793853869870,"url":"https://isitspying.com/p/dahua-ipc-hx-nvr-series-cve-2021-33044-affected-firmware"},{"id":"01M6MYDXSXJ2KFDDGFC0GXFEY3","slug":"hikvision-ds-2cd2-series-firmware-before-sept-2021-fix","vendor":"Hikvision","oem":null,"model":"DS-2CD2 series (firmware before Sept 2021 fix)","hw_revision":null,"category":"ip_camera","country_of_origin":"CN","description":"Network cameras affected by CVE-2021-36260, an unauthenticated command injection in the web server. In CISA's Known Exploited Vulnerabilities catalog.","status":"confirmed","status_reason":"CVE-2021-36260, in CISA's Known Exploited Vulnerabilities catalog","status_at":1793853869517,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851848509,"updated_at":1793853869517,"url":"https://isitspying.com/p/hikvision-ds-2cd2-series-firmware-before-sept-2021-fix"},{"id":"01M6MYDX1VB1JGN97KZJ917MM6","slug":"leagoo-m9","vendor":"Leagoo","oem":null,"model":"M9","hw_revision":null,"category":"phone","country_of_origin":"CN","description":"Budget Android phone found by Dr.Web (2018) with the Triada trojan embedded in the system firmware.","status":"confirmed","status_reason":"Documented by Doctor Web, March 2018","status_at":1793853869208,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851847739,"updated_at":1793853869208,"url":"https://isitspying.com/p/leagoo-m9"},{"id":"01M6MYDW65H5ERV59ESDTKHWCF","slug":"keecoo-p11","vendor":"Keecoo","oem":null,"model":"P11","hw_revision":null,"category":"phone","country_of_origin":"CN","description":"Android phone named by Germany's BSI in 2019 as shipping with preinstalled malware (Andr/Xgen2-CY).","status":"confirmed","status_reason":"Named in a BSI warning, Feb 2019","status_at":1793853868944,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851846853,"updated_at":1793853868944,"url":"https://isitspying.com/p/keecoo-p11"},{"id":"01M6MYDVEWVT3J170SCTV56W8T","slug":"m-horse-pure-1","vendor":"M-Horse","oem":null,"model":"Pure 1","hw_revision":null,"category":"phone","country_of_origin":"CN","description":"Android phone named by Germany's BSI in 2019 as shipping with preinstalled malware (Andr/Xgen2-CY).","status":"confirmed","status_reason":"Named in a BSI warning, Feb 2019","status_at":1793853868682,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851846108,"updated_at":1793853868682,"url":"https://isitspying.com/p/m-horse-pure-1"},{"id":"01M6MYDTRN6BGE07ZXTZS7E5C5","slug":"doogee-bl7000","vendor":"Doogee","oem":null,"model":"BL7000","hw_revision":null,"category":"phone","country_of_origin":"CN","description":"Android phone named by Germany's BSI in 2019 as shipping with preinstalled malware (Andr/Xgen2-CY).","status":"confirmed","status_reason":"Named in a BSI (German federal cyber agency) warning, Feb 2019","status_at":1793853868401,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851845397,"updated_at":1793853868401,"url":"https://isitspying.com/p/doogee-bl7000"},{"id":"01M6MYDT1S8ZYECJ7RJSYPSWQ3","slug":"gigaset-gs270","vendor":"Gigaset","oem":null,"model":"GS270","hw_revision":null,"category":"phone","country_of_origin":"DE","description":"Android phone that received malware (Android.RemoteCode / Trojan droppers) through the manufacturer's compromised update server in April 2021.","status":"confirmed","status_reason":"Vendor confirmed the compromised update server (April 2021)","status_at":1793853868138,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851844665,"updated_at":1793853868138,"url":"https://isitspying.com/p/gigaset-gs270"},{"id":"01M6MYDS92GZGVGPH21VS2GMT0","slug":"blu-r1-hd","vendor":"BLU","oem":"Adups (FOTA component)","model":"R1 HD","hw_revision":null,"category":"phone","country_of_origin":"CN","description":"Budget Android phone sold on Amazon in 2016 whose Adups firmware-update agent sent SMS content, contacts and call logs to a server in Shanghai.","status":"confirmed","status_reason":"Documented by Kryptowire (2016); BLU acknowledged and pushed an update","status_at":1793853867881,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851843874,"updated_at":1793853867881,"url":"https://isitspying.com/p/blu-r1-hd"},{"id":"01M6MYDRH1BPKPC9NNMXD6M8ME","slug":"x12-plus","vendor":null,"oem":"white-label","model":"X12 Plus","hw_revision":null,"category":"tv_box","country_of_origin":"CN","description":"Android TV box named in BADBOX research.","status":"confirmed","status_reason":"Named in HUMAN Security's BADBOX report (2023)","status_at":1793853867597,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851843105,"updated_at":1793853867597,"url":"https://isitspying.com/p/x12-plus"},{"id":"01M6MYDQSRP51K541CGR6P3445","slug":"q9","vendor":null,"oem":"white-label","model":"Q9","hw_revision":null,"category":"tv_box","country_of_origin":"CN","description":"Android TV box named in BADBOX research.","status":"confirmed","status_reason":"Named in HUMAN Security's BADBOX report (2023)","status_at":1793853867301,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851842360,"updated_at":1793853867301,"url":"https://isitspying.com/p/q9"},{"id":"01M6MYDQ0KM1FQKFY0QZQ9KXKZ","slug":"x88-pro-10","vendor":null,"oem":"white-label","model":"X88 Pro 10","hw_revision":null,"category":"tv_box","country_of_origin":"CN","description":"Android TV box named in BADBOX research.","status":"confirmed","status_reason":"Named in HUMAN Security's BADBOX report (2023)","status_at":1793853867032,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851841555,"updated_at":1793853867032,"url":"https://isitspying.com/p/x88-pro-10"},{"id":"01M6MYDP7XRQ89Q9C59685717R","slug":"t95max","vendor":null,"oem":"white-label","model":"T95Max","hw_revision":null,"category":"tv_box","country_of_origin":"CN","description":"Android TV box in the T95 family named in BADBOX research.","status":"confirmed","status_reason":"Named in HUMAN Security's BADBOX report (2023)","status_at":1793853866746,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851840765,"updated_at":1793853866746,"url":"https://isitspying.com/p/t95max"},{"id":"01M6MYDNEXGTKZEF9WWDRZ6780","slug":"t95z-plus","vendor":null,"oem":"white-label","model":"T95Z Plus","hw_revision":null,"category":"tv_box","country_of_origin":"CN","description":"Android TV box in the T95 family named in BADBOX research.","status":"confirmed","status_reason":"Named in HUMAN Security's BADBOX report (2023)","status_at":1793853866486,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851839965,"updated_at":1793853866486,"url":"https://isitspying.com/p/t95z-plus"},{"id":"01M6MYDMMQE4AZXHKK6BDN70QR","slug":"t95","vendor":null,"oem":"AllWinner / Rockchip white-label","model":"T95","hw_revision":null,"category":"tv_box","country_of_origin":"CN","description":"Unbranded Android TV box sold on Amazon, AliExpress and others. Shipped with firmware-level malware (BADBOX / 'Peachpit' ad fraud) that contacts a command server at first boot.","status":"confirmed","status_reason":"BADBOX firmware malware documented by HUMAN Security (2023) and the FBI (2025)","status_at":1793853866196,"status_manual":1,"report_count":1,"verified_count":1,"created_by":"01M6MYDMJ4H4JTJ0TK8JWT1E1B","created_at":1793851839127,"updated_at":1793853866196,"url":"https://isitspying.com/p/t95"}]}