MuleSkin

WHAT THE ALERTS MEAN

FIRST: MOST ALERTS ARE NOTHING

The board reports what it hears: cameras, plate readers, trackers, drones, strange WiFi. Nearly all of it is the world going about its business — a doorbell camera, a neighbour's AirTag, a delivery van's dashcam. An alert says this is nearby, not this is about you.

The alerts below are the ones that can be about you, and what to do about each.

WITH YOU

A tracker (AirTag, Tile, SmartTag or Find My Device tag) has stayed near you for twenty minutes or more while you moved — the devices around you kept changing and it did not. This is the strongest sign the board gives that something is travelling with you.

What to do:

Use your phone's own scan: iPhone — Find My → Items → Identify Found Item; Android — Settings → Safety & emergency → Unknown tracker alerts → Scan now. Either can make the tag play a sound.
Walk around: the signal on the alert screen gets stronger as you get closer. Check bags, coat pockets, the car (wheel arches, under seats, the boot).
Your own things count too — a family member's AirPods case or a borrowed bag. If it is yours, add it to the ignore list (the IGNORE button on the push, or IGNORED DEVICES on the flasher page).
If you feel unsafe, don't confront anyone. Keep the tag as evidence and contact the police or a support service.

NEAR YOU ON N DAYS

The same tracker, away from its owner, has turned up near the board on three or more different days — counted only while the board was away from home. A tag following you is heard in different places on different days; a neighbour's tag in the house next door is heard only at home, so it never counts.

For that, the board needs to know your home: on the board, mark your home WiFi network USE. With no home set, every day counts, and a tag that lives near your home can raise this alert.

The board learns your home router each time it joins that network, so a hotspot with the same name somewhere else is not taken for home. Before an alert, the board's LOG shows a tracker's count beside it (“2d away”), and the flasher page's AWAY DAYS lists every count, with a button to forget one.

What to do: the same as WITH YOU — scan with your phone, search your things and car. If it is a tag you know, ignore it.

AWAY FROM OWNER

Trackers say in their own broadcast whether their owner's phone is nearby. One that says its owner is not nearby is the kind that could be planted on someone; one with its owner is just someone's keys walking past. The board flags only the first kind as a high-confidence tracker, and the LIVE VIEW on the flasher page puts them on top, in red.

A single AWAY FROM OWNER is common — lost keys, a tag left in a car, a bike tracker. It matters when it repeats or stays: that is what WITH YOU and NEAR YOU ON N DAYS look for.

SPAM: FAKE TAGS

Somebody nearby is broadcasting fake trackers, each from a new address (it happens at hacker events, and with Flipper-style gadgets). The board says so once and then stays quiet about that kind of tracker for five minutes after the flood stops. Real tags of that kind are held too for those five minutes; WITH YOU still works.

HACKER, EVIL TWIN, DEAUTH

HACKER: A WiFi access point answering to many different network names from one address — a "karma" attack (a WiFi Pineapple and its copies). Phones that once joined "Cafe WiFi" can join it on their own. Turn off WiFi auto-join for open networks; don't use open WiFi nearby.
EVIL TWIN: A fake copy of a nearby network, made to catch people who join it. Use mobile data until you leave.
DEAUTH: Devices are being knocked off a WiFi network on purpose — often the first step of the two above, or jamming of a WiFi camera.

CONFIDENCE

Each detection carries how sure the board is. The LOG and the flasher's log export show it.

HIGH: A signature that exists on nothing else — a tracker saying it is away from its owner, a service ID only that product uses, a drone's Remote ID.
MED: A good sign but not a unique one — a matching device name, a maker's ID that also turns up on other products.
LOW: Only a hint, such as a name any gadget could have. Logged.

By default every match interrupts with the alert screen; the board's settings menu has a confidence filter to hold back the lower ones.

PUSHES TO YOUR PHONE

With pushes set up, each alert has buttons:

IGNORE: This device, for good — your own tags, your car's dashcam.
SNOOZE: This device, for a while.
PAUSE: All pushes for two hours. WITH YOU still comes through.
UNDO: Takes back the last of the above.

The same list is on the flasher page under IGNORED DEVICES, with the board plugged in.

« back to the flasher · MuleSkin-CYD is built on SquachWatch-CYD by skizzophrenic. The board is a warning light, not proof: if you believe you are being tracked, contact the police or a support service.