https://live.paloaltonetworks.com/t5/general-topics/changes-to-sinkhole/m-p/1243243#M125656 <P>Starting early yesterday we began seeing a lot of activity from a subset of iPhones on our network getting mask.icloud.com caught by sinkhole.paloaltonetworks.com<BR /><BR />We've been unable to find any commonalities between the devices.&nbsp; Wondering if anyone has been seeing anything similar or if this is a known issue?</P> Fri, 05 Dec 2025 17:35:59 GMT M.Crow 2025-12-05T17:35:59Z https://live.paloaltonetworks.com/t5/general-topics/changes-to-sinkhole/m-p/1243243#M125656 <P>Starting early yesterday we began seeing a lot of activity from a subset of iPhones on our network getting mask.icloud.com caught by sinkhole.paloaltonetworks.com<BR /><BR />We've been unable to find any commonalities between the devices.&nbsp; Wondering if anyone has been seeing anything similar or if this is a known issue?</P> Fri, 05 Dec 2025 17:35:59 GMT https://live.paloaltonetworks.com/t5/general-topics/changes-to-sinkhole/m-p/1243243#M125656 M.Crow 2025-12-05T17:35:59Z https://live.paloaltonetworks.com/t5/general-topics/changes-to-sinkhole/m-p/1243250#M125657 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/1494946589">@M.Crow</a>&nbsp;</P> <P>&nbsp;</P> <P>There are two destinations&nbsp;<SPAN><STRONG><EM>mask.icloud.com</EM></STRONG> and&nbsp;<EM><STRONG>mask-h2.icloud.com</STRONG></EM> that are required for <A title="Apple iCloud Private Relay" href="https://developer.apple.com/icloud/prepare-your-network-for-icloud-private-relay/" target="_blank" rel="noopener">Apple iCloud Private Relay</A>.</SPAN></P> <P><SPAN>Both destinations are identified by DNS Security as&nbsp;<STRONG>Proxy Avoidance And Anonymizers</STRONG>. This behavior from Palo Alto Networks is not new and I observed long time ago.</SPAN></P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="CosminM_0-1764967734312.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/70043iCE60AF068C1684B8/image-size/medium?v=v2&amp;px=400" role="button" title="CosminM_0-1764967734312.png" alt="CosminM_0-1764967734312.png" /></span></P> <P>The iCloud Private Relay — part of an iCloud+ subscription — helps protect user privacy when they browse the web in Safari. (<A href="https://support.apple.com/en-us/102602" target="_blank" rel="noopener">About iCloud Private Relay - Apple Support</A>)</P> Fri, 05 Dec 2025 20:49:13 GMT https://live.paloaltonetworks.com/t5/general-topics/changes-to-sinkhole/m-p/1243250#M125657 CosminM 2025-12-05T20:49:13Z