A throwaway macOS VM ran the real wallet; every byte was captured and decrypted from the host, outside the guest. The full request log (flows.jsonl) holds decrypted bodies and stays private — tooling at github.com/austintgriffith/crops-lab.
run_id: 20260929-162946-send-eth-rabby-localnode action: send-eth-rabby-localnode guest_ip: 192.168.64.4 host_proxy: 192.168.64.1:8080 base_image: crops-warm-rabby action_rc: 0 gold_baked_at: 2026-08-21T02:54:20Z gold_base: ghcr.io/cirruslabs/macos-tahoe-base:latest gold_base_row: OCI ghcr.io/cirruslabs/macos-tahoe-base:latest 50 33 1 hour ago stopped gold_macos: 26.6.2 (25G83) gold_chrome: Google Chrome 151.0.7922.174 gold_node: v26.7.0 gold_playwright: 1.62.1 gold_quic_allowed: 0
[t=1790721036.446] send-eth-rabby: extension id ohalidldpbnnblpakdicpoleffldpmlh -> send 0.0002 ETH to 0x34aa3f359a9d614239015126635ce7732c18fdf3 (node http://192.168.68.54:8545) [t=1790721039.838] unlock (start): submitted [t=1790721269.417] custom rpc listed: true [t=1790721272.699] rpc-edit: done — browser restarted; everything after this is on http://192.168.68.54:8545 [t=1790721275.236] unlock (local): submitted [t=1790721287.598] amount field: 0.0002 [t=1790721315.955] send-eth-rabby: done
# capture 20260929-162946-send-eth-rabby-localnode action: send-eth-rabby-localnode · guest 192.168.64.4 · proxy 192.168.64.1:8080 · action_rc 0 ## decrypted: 363 requests · 28 hosts | host | req | methods | secret headers present | |---|---:|---|---| | static.debank.com | 118 | GET | — | | api.rabby.io | 71 | GET/POST | cookie,x-api-key | | www.google-analytics.com | 40 | POST | — | | api.hyperliquid.xyz | 36 | GET/POST | — | | matomo.debank.com | 28 | POST | — | | 192.168.68.54 | 10 | POST | — | | android.clients.google.com | 9 | POST | authorization | | festats.debank.com | 6 | GET | — | | ocsp2.apple.com | 5 | GET | — | | cma.itunes.apple.com | 5 | POST | — | | radarsubmissions.apple.com | 5 | POST | — | | sas.pcms.apple.com | 4 | GET | — | | www.google.com | 4 | GET | — | | pancake.apple.com | 4 | GET | — | | bag.itunes.apple.com | 4 | GET | — | | accounts.google.com | 2 | POST | — | | cf.iadsdk.apple.com | 1 | POST | — | | iadsdk.apple.com | 1 | POST | — | | stocks-data-service.apple.com | 1 | GET | — | | gsp57-ssl-background.ls.apple.com | 1 | POST | — | | example.com | 1 | GET | — | | clients2.google.com | 1 | GET | — | | static-assets.rabby.io | 1 | GET | — | | device-config.pcms.apple.com | 1 | GET | — | | token.safebrowsing.apple | 1 | GET | — | | calendars.icloud.com | 1 | GET | — | | valid.apple.com | 1 | GET | — | | unlinkability.apple.com | 1 | GET | — | ## opaque: 0 SNIs offered, never decrypted (pinned or handshake failed) - none ## wire: 8661 proxied pkts · 0 BYPASS dst · 1 QUIC dst · 1158 Apple-OS pkts BYPASS/QUIC below exclude Apple 17.0.0.0/8 (macOS push/OCSP/update — not the browser under test). ### QUIC LEAK — udp/443 left the guest - 199.232.65.64 (?) · 16 pkts ### other egress (non-443, non-DNS) - 192.168.64.255:137 (no DNS seen) · 18 pkts - 224.0.0.251:5353 (no DNS seen) · 3 pkts