Wyze NEW OG Cam - Replacing the 1st NEW OG Cam I recently purchased - Tries to communicate with China servers

I purchased a Wyze Cam OG a month ago, and noticed it stopped recording events after a while.

I already have V2’s V3’s and other OG’s that work perfectly fine for some time.
Only the NEW OG, is giving me problems where is stops recording events.
SOOOO I returned it, and obtain another NEW OG cam, installed it.

SAME problem!
Stops recording Events after a while.

So I performed some network diagnostic.
What I found shocked me

The NEW OG Cam is constantly trying to communicate multiple times a minute back to China

Thankfully I block ALL internet traffic from MY network, that may try to communicate with China/Asia.

There is NO reason for Wyze, to have their Cameras, communicate back to China, NONE!

here is a SMALL sample of my Firewall logs

X.X.X.197
is my NEW OG cam

114.114.114.114
are servers in China ( my network firewall is blocking it)

I have 1000’s of logged events in my Firewall logs, where the OG Cam is trying to communicate with China servers.

Again, There is NO Reason for Wyse Cam’s to be communicating with China servers, For ANYTHING!

BIG BIG Red Flag!

It’s ridiculous they won’t work without internet and they have completely removed rtsp I would never buy crap from them again

This issue I just discovered in trying to find out WHY 2 new OG cams stop recording after a little while, an my old OG cams have NO problem, and the old ones DONT try to communicate with China either.
It raises a BIG Red Flag for me, to the point I may decide to yank ALL my Wyze cams out.

China is not our ( U.S.) friend, and is constantly performing all types threats, to businesses, gov, personal, and U.S. military, as I follow the news stories on China’s risk, and attacks for some years now, and even document them.

Here is a TINY sample of SOME of the recent headlines on China

– Inside the Chinese fraud rings stealing billions from banks and retailers
– Former top cop warns of loophole exploited by illicit Chinese vape companies ‘targeting our youth’
– Noem warns of ‘coordinated’ effort to funnel Chinese nationals into US
– China-nexus group linked to multiyear campaign targeting US, Canadian medical research
– Beijing escalating AI espionage to catch up with the U.S. on tech, cybersecurity firm says
– Robot mower flaw could open your home network -Robot mower flaw could open your home network -China
Security researcher warns Yarbo robots may expose remote access, live cameras and home Wi-Fi data
– Chinese national arrested at JFK after allegedly photographing US military aircraft at Nebraska base
– Federal judge revokes US citizenship of Chinese couple convicted of stealing medical trade secrets for China
– Stanford student reveals sick way Chinese Communist Party allegedly stalked her on campus: ‘Personally targeted’
– Chinese spy tech is endangering US hospitals. Texas is trying to shut that down
– China-linked hackers breached dozens of telecoms, government agencies
– Feds investigate alleged Chinese-linked biolab found in Las Vegas home
– US Navy sailor Jinchao Wei sentenced to 16 years in prison for selling secrets to China after being encouraged by mother

This is DNS traffic (UDP port 53) to a well known APAC DNS server, and many of the cam models do it. Hardcoded into the driver or firmware somewhere. DNS traffic does not have personal info in it and is not malicious.

FYI it is 114.114.114.114. 144.144.144.144 is US Department of Defense. I’d be more concerned if it was connecting there.

Unblock it and see what it connects to after that, it may be that the bootloader just needs to contact that sever once during startup, but because you’re blocking it, eventually it gives up and stops functioning properly. Or it may not be related to your problem at all.

Please don’t start with the repeated posting of news headlines related to China again. It is not accomplishing anything.

If you don’t want anything from China in your house, good luck, especially with electronics. Even brands made in other countries use components from China.

They don’t need to have cloud access if I’m recorded locally I killed the internet on that vlan and they go into a continuous boot loop cause restarting WiFi cause they can’t reach their cloud service

As explained in my reply on the other post, yes, they do.

Think of these cams as a “dumb terminal” type PC. They run using a remote server with just a minimal local OS. Same idea here.

Ehat I’m saying there is absolutely no reason for this. I have several other brands including mostly reolink and armrest and one tp link. Only needed internet for initial setup. The vlan I have my cams in have no outside connection and all those work. I don’t need ir what their apps . And I don’t use them

Yes, Thanks I understand it is DNS Traffic, and DNS traffic to China.
I worked in IT for many years

NO reason whatsoever to have ANY traffic going to China,
from one Wyze device, and ALL my other Wyze cam’s don’t but work fine.

1.) From a Computer/Network, or device performance aspect
This is also NOT efficient, for a Wyze cam device to try to communicate to servers on the other side of the planet, when the devices can do the same thing with CLOSE BY U.S. servers.

2.) here is something else very interesting…IF the Wyze Cam’s have Hard Coded DNS server IP addresses pointing to China and embedded in their devices,. WHY did my NEW OG Wyze cam, have a huge amount ( multiple times a second) of DNS queries, to the 114.114.114.114. China network address, and then STOP, and started pointing to other NON China address,

If something is hard coded into the Cam it should not change
If it Change, then it is NOT hard coded.

Let me provide a link to an IT Security topic by an Computer Security Software company
Well known too!

Of how China used DNS servers and ports
To take over user devices, or to distribute “software payloads” to one, or many devices

Never blindly trust any traffic going to known ports, as it is clearly shown in the security report below

PlushDaemon compromises network devices for adversary-in-the-middle attacks

1st off, the NEW problematic OG Cam (2nd one in last few weeks with the same problem) works for about 10 hours or so, before it STOPS recording events…

I am not going to unblock my firewall filters just to accommodate 1 Wyze NEW problematic OG cam device that has a problem after a short while that stops detecting, and recording Events. Actually 2 NEW OG cam’s in the last 3 weeks, that have the same problem.

When my other 10 Wyze Devices work perfectly fine while my network server firewall blocks ALL China internet traffic.

I will just return the 2nd NEW Wyze OG cam for a refund
there is NO reason for the OG cam to try to communities MULTIPLE times a second
Back to China

I have many other NON - Wyze Devices that work perfectly fine, with the firewall blocking ANY and ALL China bound traffic.

I have 3 Android TV OON boxes
I successfully use MuMu “China” android emulator, ( which also tried to direct traffic to China" and the software product is made in China.)- But since I block all China traffic, it can’t communicate with China. and it all still works

I also just don’t throw my hands up and say Oh well, and allow all devices to connect to China
People, companies, etc, that understand the China threat (security news/events are reported DAILY), people and companies take actions to protect themselves, or their companies.

Maybe not for you, but I am sure it helps informing others, of the threats, risks, and daily attacks by China,

And what I have posted is just a TINY sample of all the reported threats /attacks and such by China…

As the saying goes, “You can lead a horse to water, but you can’t make them drink”

Here is news headline from just the last few days
“” [Chinese Telecom Companies Infiltrate U.S. Infrastructure]Stranger Pings: Chinese Telecom Companies Infiltrate U.S. Infrastructure | Select Committee on the CCP

FBI labels suspected China hack of law enforcement data ‘a major cyber incident’

“”" ‘Flying Eagle’ Full-Service Mobile RAT Builder Wings Across China
https://www.darkreading.com/endpoint-security/flying-eagle-mobile-rat-builder-china

One should never blindly trust anything China related/connected

As you just proved my point!

Wyze Cam’s are dumb terminals,
That communicate back to China SERVERS
That Serve! whatever China wants them to serve, whenever they want

Now read this article below
And you will have a better understanding of the Major Security Risks
coming from China

And Through! DNS ports!
PlushDaemon compromises network devices for adversary-in-the-middle attacks

To add to the facts/points you raised in your post

It is ALSO not efficient for Wyze Cam’s residing in the U.S. to point to DNS servers on the other side of the world in China, when the Wyze Cams, can point locally and be more efficient with DNS queries when pointing to DNS servers in the U.S.

While also drastically reducing the Risks from China

providing a Follow up

Here are RISKS using China based DNS server
Google AI results to the topic

So yes, Wyze Devices pointing to Chinese DNS servers
Poses a HUGE security risk

Follow up to your recommendations to Disable my Firewall BLOCK China rule

I disable the Firewall rule
It has done nothing for the OG cam to start recording events again
BUT the cam is now communicating with China servers

Here is when the NEW OG Cam stopped recording events last night at 11:59
( Top of Video is a LIVE camera view - Recorded Events below that -Last one at 11:59PM 8-6-2026)…and still not recording events… If I reboot the OG cam, it will start recording events again

Here is the screen shot of the firewall logs
Showing the OG Cam is now allowed to communicate with the China 114.114.114.114 servers

Take note: How many times per second the Wyze OG cam, is communicating with the China servers… Very Abnormal

Probably located in Flushing Queens or the Lower East Side of Manhatten just across the river from you.
laughing

Is there a difference from Flushing Queens, and China?

Seen on the news the last few days,
Now many fraudulent Senior Care facilities there are that are TOTALLY empty of
Seniors !!

Inside New York’s medical fraud capital where often empty senior centers bill Medicaid $100M-a-year for patients

Queen seems to be China’s back door !

Just taking advantage of LAZY federal and state workers. :grin:

I may not have explained myself regarding the medical fraud with senior centers.
These are all 3rd party private “senior care” centers, that are defrauding the U.S. Gov/Medicaid.
All the ones shown were Chinese “front” business, posing as “Senior Care centers, billing Medicaid for millions, and NONE of them have had 'Seniors” found in the offices/buildings…

Basically huge medical fraud against Medicaid.
making over 100 Mil a year

Hi @compserv111 , thanks for sharing this. When you see this behavior again, could you please submit a log and share the log ID with us? Thanks!

Hi WyzeEnTing,

I have continued to investigate this issue.
And there appears to be 2 separate issues, or 1 issue and 1 security concern.

I may have found the cause of the 2 NEW OG cams, ( One was returned to Amazon, and I ordered another) Same issue on both.

Record events for some hours and then stops recording events.

I have tried something, and will know within a 24 hour cycle if I discovered the reason for the OG cam, stops recording after so many hours, and the only way I can to get it to record events again, was to reboot the NEW OG Cam.

By tomorrow morning (24 hours of OG cam record cycle), I will know if I have pinpointed the issue, and if I did, I will provide the details so that Wyze can let all users know.

If I don’t pinpoint the issue, and the OG cam, stops recording again, I will submit the logs to Wyze Support.

#2 issue
In regards to the OG CAM, drastically making “DNS” calls many times per second as was shown in the Firewall logs screen capture posted, That is a Big concern. I have been saving the Firewall logs.

Odd thing is, It makes the DNS calls many time a second for a while,
and then stops, and goes back to normal DNS ip addresses, NON China…as if someone switched if Off from connecting/contacting the Chine DNS 114.114.114.114, and then eventually goes to the normal DNS addresses that the other cam models use 8.8.8.8, or 8.8.4.4, and also geos back to AWS common IP addresses 18.246.224.213, 52.89.123.96 etc…forthe cam storage.

I can submit those .csv txt file dumps if you would like from the firewall logs
Just PM me a contact email address
:+1:

Hi @compserv111 , thanks for the detailed update and for testing this on your side. For the event recording issue, if it happens again, please submit a log and share the log ID with me.

For the DNS requests, thank you for saving the firewall logs. Please send the log files to security@wyze.com and feel free to cc enting.sung@wyze.com. If possible, please also submit an app log through the Wyze app and include the log ID in the email. I’ll help follow up on this issue. Thanks!

Hi, NEW OG cam just stopped recording again

Log ID: 2502491

In a little while I will send the Firewall logs, Not sure if there is any relation to the OG Cam and the issue of it stops recording events after a while, but the Firewall logs will show the China DNS server attempts many times.

What I checked so far, the timeline of OG cam stopping event recordings, and the Firewall Logs - Showing a lot of DNS queries to China DNS Servers, the timelines of both do not line up… but that is just my initial review of everything

Please keep in mind, this is the 2nd OG cam that I purchased, after returning the 1st one over the last few weeks ..BOTH had the same problem…

Thank You Guys!