12-05-2025 09:35 AM
Starting early yesterday we began seeing a lot of activity from a subset of iPhones on our network getting mask.icloud.com caught by sinkhole.paloaltonetworks.com
We've been unable to find any commonalities between the devices. Wondering if anyone has been seeing anything similar or if this is a known issue?
12-05-2025 12:45 PM - edited 12-05-2025 12:49 PM
Hello @M.Crow
There are two destinations mask.icloud.com and mask-h2.icloud.com that are required for Apple iCloud Private Relay.
Both destinations are identified by DNS Security as Proxy Avoidance And Anonymizers. This behavior from Palo Alto Networks is not new and I observed long time ago.
The iCloud Private Relay — part of an iCloud+ subscription — helps protect user privacy when they browse the web in Safari. (About iCloud Private Relay - Apple Support)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
