u/JalilaDjadi

On Android, PCAPdroid flagged connections from both WhatsApp Business and ChatGPT to 176.65.148.67:123 as potentially malicious. I know port 123 is just NTP and the traffic itself looks like a normal time sync request, but the IP appears to be a Tor endpoint linked to PFCloud, which makes it look suspicious. Not sure why these apps would connect to it. Has anyone else seen this?