A throwaway macOS VM ran the real wallet; every byte was captured and decrypted from the host, outside the guest. The full request log (flows.jsonl) holds decrypted bodies and stays private — tooling at github.com/austintgriffith/crops-lab.
run_id: 20260831-213515-recover-metamask action: recover-metamask guest_ip: 192.168.64.2 host_proxy: 192.168.64.1:8080 base_image: crops-gold action_rc: 0 gold_baked_at: 2026-08-21T02:54:20Z gold_base: ghcr.io/cirruslabs/macos-tahoe-base:latest gold_base_row: OCI ghcr.io/cirruslabs/macos-tahoe-base:latest 50 33 1 hour ago stopped gold_macos: 26.6.2 (25G83) gold_chrome: Google Chrome 151.0.7922.174 gold_node: v26.7.0 gold_playwright: 1.62.1 gold_quic_allowed: 0
[t=1788233781.719] recover-metamask: extension id canglmpflkjehkfaioejbblmakepelcl [t=1788233787.368] click import-mode: onboarding-import-wallet (click) [t=1788233789.908] click open-srp: text:Import using Secret Recovery Phrase (click) [t=1788233793.208] click srp-paste-btn: text:Paste (click) [t=1788233794.415] srp pasted (0 words) [t=1788233794.536] click srp-continue: import-srp-confirm (click) [t=1788233803.759] skip metrics (not present) [t=1788233803.882] fill pw-new: create-password-new-input [t=1788233803.926] fill pw-confirm: create-password-confirm-input [t=1788233803.958] click pw-terms: create-password-terms (click) [t=1788233804.620] click pw-submit: create-password-submit (click) [t=1788233808.373] click advance-0: text:Maybe later (click) [t=1788233810.237] click advance-1: text:Continue (click) [t=1788233812.092] click advance-2: onboarding-complete-done (click) [t=1788233816.297] click advance-3: onboarding-complete-done (click) [t=1788233823.394] skip advance-4 (not present) [t=1788233823.394] recover-metamask: restored — idling for RPC/token re-sync under capture [t=1788233847.588] skip open-tokens (not present) [t=1788233862.682] recover-metamask: done
# capture 20260831-213515-recover-metamask action: recover-metamask · guest 192.168.64.2 · proxy 192.168.64.1:8080 · action_rc 0 ## decrypted: 289 requests · 48 hosts | host | req | methods | secret headers present | |---|---:|---|---| | tron-mainnet.infura.io | 38 | GET/OPTIONS/POST | — | | solana-mainnet.infura.io | 27 | GET/OPTIONS/POST | — | | price.api.cx.metamask.io | 25 | GET | authorization | | metamask.github.io | 23 | GET | — | | mainnet.infura.io | 21 | POST | — | | bitcoin-mainnet.infura.io | 20 | GET | — | | static.cx.metamask.io | 10 | GET | — | | token.api.cx.metamask.io | 9 | GET | — | | authentication.api.cx.metamask.io | 8 | GET/POST/PUT | authorization | | user-storage.api.cx.metamask.io | 8 | GET | authorization | | accounts.api.cx.metamask.io | 7 | GET | authorization | | tokens.api.cx.metamask.io | 7 | GET | authorization | | android.clients.google.com | 6 | POST | authorization | | notification.api.cx.metamask.io | 6 | POST | authorization | | rewards.api.cx.metamask.io | 5 | POST | — | | subscription.api.cx.metamask.io | 5 | GET | authorization | | pancake.apple.com | 5 | GET | — | | on-ramp-cache.api.cx.metamask.io | 4 | GET | — | | api.merkl.xyz | 4 | GET | — | | cdn.contentful.com | 4 | GET | — | | cma.itunes.apple.com | 4 | POST | — | | api.segment.io | 3 | POST | — | | sentry.io | 3 | POST | — | | bag.itunes.apple.com | 3 | GET | — | | acl.execution.metamask.io | 2 | GET | — | | phishing-detection.api.cx.metamask.io | 2 | GET | — | | linea-mainnet.infura.io | 2 | POST | — | | polygon-mainnet.infura.io | 2 | POST | — | | arbitrum-mainnet.infura.io | 2 | POST | — | | optimism-mainnet.infura.io | 2 | POST | — | | base-mainnet.infura.io | 2 | POST | — | | bsc-mainnet.infura.io | 2 | POST | — | | monad-mainnet.infura.io | 2 | POST | — | | images.ctfassets.net | 2 | GET | — | | example.com | 1 | GET | — | | clients2.google.com | 1 | GET | — | | www.google.com | 1 | GET | — | | accounts.google.com | 1 | POST | — | | chainid.network | 1 | GET | — | | geolocation.api.cx.metamask.io | 1 | GET | — | | client-config.api.cx.metamask.io | 1 | GET | — | | on-ramp.api.cx.metamask.io | 1 | GET | — | | defiadapters.api.cx.metamask.io | 1 | GET | — | | bridge.api.cx.metamask.io | 1 | GET | — | | client-side-detection.api.cx.metamask.io | 1 | GET | — | | oidc.api.cx.metamask.io | 1 | POST | — | | gateway.api.cx.metamask.io | 1 | GET | — | | device-config.pcms.apple.com | 1 | GET | — | ## opaque: 0 SNIs offered, never decrypted (pinned or handshake failed) - none ## wire: 2552 proxied pkts · 3 BYPASS dst · 1 QUIC dst · 150 Apple-OS pkts BYPASS/QUIC below exclude Apple 17.0.0.0/8 (macOS push/OCSP/update — not the browser under test). ### BYPASS — guest spoke TLS to these directly, not through the proxy - 23.217.76.214 (?) · 33 pkts - 199.232.67.6 (no DNS seen) · 5 pkts - 23.60.175.11 (no DNS seen) · 4 pkts ### QUIC LEAK — udp/443 left the guest - 199.232.67.6 (no DNS seen) · 15 pkts ### other egress (non-443, non-DNS) - 192.168.64.255:137 (no DNS seen) · 15 pkts - 23.11.32.159:80 (no DNS seen) · 12 pkts - 104.18.38.233:80 (no DNS seen) · 4 pkts - 224.0.0.251:5353 (no DNS seen) · 4 pkts