Who is your Boox device talking to?

Boox e-reader traffic can be monitored cleanly by routing the device through a Linux laptop hotspot and inspecting the resulting packets with Wireshark, and the observed “phoning home” looks largely consistent with normal app and cloud-sync behavior rather than suspicious data exfiltration. After filtering traffic by the device’s hotspot IP, the connections that appear during active use and during a half-hour idle period mostly map to expected services: Boox’s own cloud, Amazon endpoints, Google/Play services, Stack Storage sync, and routine time/health checks.

The core method matters because it avoids a common blind spot: installing a monitoring app on the device can be undermined if the device controls what that app can see. Instead, the setup forces all network traffic from the Boox device to pass through the user’s laptop, where packet capture is performed remotely over SSH. With Wireshark running on the laptop, the analyst filters by the Boox device’s source IP (assigned by the hotspot) and then examines both raw packet streams and higher-level “conversations” and “name resolution” summaries.

During active use—opening notes and launching apps—traffic spikes in a way that matches typical Android behavior: DNS lookups and connections to major services show up, including Amazon (expected for cloud-backed storage), EUR books.com (tied to Boox web services), and other cloud endpoints used for sync and analytics. When the device sits idle for about 30 minutes, the traffic becomes “boring”: Boox cloud pings continue, and small, low-volume checks appear. A notable example is NTP (network time protocol) traffic to DataDog-related endpoints, interpreted as monitoring/latency and time synchronization checks rather than bulk data transfer.

The most concerning category—unexpected third-party tracking—does show up, but in small volume. Even with no Facebook apps installed, connections to Facebook endpoints appear, described as likely commercial or tracking-related activity. Still, the amount is characterized as only a few kilobytes, far from the kind of sustained, high-volume upload that would suggest covert data dumping.

The analysis also highlights a key limitation: HTTPS prevents inspection of what’s inside encrypted connections, so packet capture can confirm who is contacted and roughly how much data moves, but not the exact payload content. To test behavior, the analyst changes a PDF and observes a jump to roughly megabyte-scale upload consistent with syncing a new document; afterward, traffic drops back to kilobyte-level updates, suggesting the device’s internal representation (e.g., pen strokes) and sync strategy are efficient.

Overall, the takeaway is practical: using the Boox device appears safe enough for the analyst’s use case, especially when notes are not highly sensitive and cloud sync is understood. The analyst adds that sync destinations may vary by region (European vs US servers), and for a “lock-in” alternative, the Boox ecosystem’s PDF generation and syncing relies on kync, which writes PDFs to user-controlled storage such as Google Drive or Dropbox. For those who want deeper assurance, the analyst recommends longer monitoring runs, but argues that suspicious background behavior would likely surface in shorter idle and active tests.