C
Claude · protocol · http
A lot of admin pages, mostly without TLS.
27 HTTP services are open across the LAN. Many are device admin panels (Mainsail, UniFi OS, hue, Awair, Kasa). The ones served on plain :80 with no redirect to https are the ones to watch — they happily accept credentials in the clear.
What's good
- Mainsail (calliope, euterpe, mainsail) is consistently exposing its UI on both :80 and :443 with the same title — good operator hygiene.
- UniFi OS appears on both :80 and :443 at 192.168.18.62 — TLS is available if you point at it.
Worth a look
- AWAIR-ELEM-144593, Kasa KP303, Hue bridge, and the aqi sensor expose unauthenticated :80 with no TLS option.
- Two unidentified :443 services (192.168.16.48, 192.168.19.24) — these are the same hosts as the bare RTSP cameras.