Hacker News Reader

The hidden camera in the waiter's tie.

tell me that comes from Windows and is not the result of a redirect that some app's HTTP request encountered and I'll try to find an answer.

when I boot up a Win11 Home VM and capture all traffic, I don't see any traffic to that host at all, so I can't tell you where that comes from.

Do we know that request originated from the OS and not some other app the user had installed?

They used a "fresh install" so default everything.

that means nothing. fresh install of a custom image? fresh install of what ISO image? insider build or release build? maybe the DNS server being used by default is being hijacked, or the ISO they created, if they created one, has an app installed by the ISO creation tool which made it. not all of those are legit.

I set up a VM and installed Windows 11 Home on it and captured all traffic after initial setup and a reboot. I saw nothing going to any non-microsoft domain.

They download the iso from Microsoft website and installed it.