🧭 Navigation Panel
Main Menu → How to Detect and Defend: Systematic Signal Anomalies in BLE Mesh Bot Systems — Advanced Logs Analysis & Counter-Pressure Strategies 📡🤖 → 📑 Topic 3. BLE Scanner Log — Full Forensic Analysis Report
🚨 Previous: 📑 Topic 2. BLE Scanner Log — Full Forensic Analysis Report
➡️ Next: 📑 Topic 4. BLE Scanner - Four-Session Cross-Location Forensic Analysis
The Invisible Grid: Mapping the BLE Shadow Infrastructure
Los Angeles Forensic Technical Brief
Session 1-3
Technical Preface: Beyond Random Proximity
To the casual observer, a Bluetooth scan in a dense urban environment like Los Angeles is just "noise"—a chaotic soup of headphones, watches, and car stereos.
However, when we apply forensic timing analysis and hardware prefix classification, a different picture emerges. We are no longer looking at independent consumer devices, we are witnessing a deterministic, coordinated infrastructure that breathes in sync.
The anomaly began as a localized pulse on Melrose Ave, but it has now been verified across multiple dates and separate physical coordinates. The "fingerprint" is unmistakable:
The Pulse: Coordinated HCI STOP_ADV commands hitting dozens of devices at the exact same millisecond.
The Persistence: Consumer "privacy" protocols (RPA) being bypassed for weeks, turning personal wearables into stationary tracking beacons.
- The Signature: Hardcoded firmware TTL constants (147s, 253s, 402s) that prove these devices are running under a unified logic, not user-driven activity.
The Road Ahead
This report covers the stationary baseline at two key locations—Melrose Ave and the De Longpre Ave Ukrainian Church. This is the "control group." In the coming sessions, I will strip away the cover of these stationary grids. We will take this analysis into high-motion environments, public transport, and remote mountain trails.
If these same patterns—the same sync-groups and the same non-rotating UUIDs—appear in the wilderness or on a moving bus, we aren't just looking at a smart-building mesh. We are looking at a ubiquitous, wide-area surveillance or data-harvesting layer that follows the observer.
For now, look at the handwriting of the machine. The same "author" wrote the logs for the Melrose recycling center and the De Longpre church. Same patterns, same timing, same architecture.
BLE Scanner — Three-Session Forensic Analysis
Cross-location, cross-date anomaly report | Los Angeles, CA
Locations covered:
- Session 1 — Melrose Ave area, February 15, 2026, 10:40–10:50
- Session 2 — Same Melrose Ave area, March 8, 2026, 12:06–12:13
- Session 3 — Nativity of the BVM Ukrainian Catholic Church, 5154 De Longpre Ave, February 15, 2026, 11:24–11:28
Method: iOS BLE scanner app (day-of-year date format: 2026/02/46 = Feb 15; 2026/03/67 = Mar 8). All times are HH:MM:SS. Analysis covers sync group detection, identical-duration clustering, named device profiling, UUID anomaly analysis, and cross-session pattern matching.
MASTER COMPARISON — ALL THREE SESSIONS
| Metric | S1 · Melrose · Feb 15 | S2 · Melrose · Mar 8 | S3 · Ukrainian Ch. · Feb 15 |
|---|---|---|---|
| Total unique devices | 324 | 120 | 105 |
| Named devices | 13 (4.0%) | 6 (5.0%) | 2 (1.9%) |
| Session window | 637s (10m 37s) | 398s (6m 38s) | 254s (4m 14s) |
| Avg device visibility | 252s | 197s | 178s |
| Sync end-groups (≥3) | 32 | 15 | 9 |
| Largest single sync wave | 43 devices | 17 devices | 19 devices |
| Sync density (events/min) | 3.01 | 2.26 | 2.13 |
| Devices with identical durations | YES — pairs of 70s, 92s, 569s | YES — 4× 147s, 4× 402s | YES — 8× 253s, 5× 251s |
| Cross-session persistent UUID | — | Mi Smart Band 4 — 21 days, no rotation | — |
KEY FINDING: Sync density (~2–3 events/minute) is consistent across all three sessions at two different locations and two different dates. This is a systemic, location-independent phenomenon — not a scanner artifact.
SESSION 1 — Melrose Ave · February 15, 2026 · 10:40:03–10:50:40
Overview: 324 devices, 13 named, 637-second window.
Sync End-Time Groups (all instances ≥3 devices):
| End Time | Count | Sample UUIDs / Named Devices | Key Anomaly |
|---|---|---|---|
| 10:40:30 | 3 | 95713F0D, 1C0F35CA, DA2C0173 | First cluster, short beacons |
| 10:40:31 | 5 | CCF8428A, 1A51EAED, B84DCA17, 960EC22A, 0EF342A0 | Start times span 16 seconds |
| 10:40:35 | 5 | 855E3A48, 471834EE, B187D6C5, 8893CA6D, 91CD9BEA | Start times span 19 seconds |
| 10:41:14 | 4 | 0784FBA1, B7E41EC0, AD83A313, C1341E27 | Two devices: exactly 70s each |
| 10:41:46 | 5 | 9CCB5C59, ADC61B87, B1280FAB, CEF64338, 7A943E85 | Two devices: exactly 92s each |
| 10:42:10 | 4 | CD00AD4E, 06966A1A, C1B5E7EA, 9B2DDC99 | Named S5319b4ec319173e5C in group |
| 10:42:14 | 3 | 5C5DDE42, EF89BCAB, A2086F87 (B8) | Named B8 included |
| 10:44:04 | 3 | D0CA7C82, 2BB1C2BA, BC294E20 | Starts differ by 4 minutes |
| 10:44:59 | 4 | BBFA822C, 4412368C, F356F08F, F1364E1F | All started 10:40:04–16 |
| 10:45:02 | 3 | B1656E12, 9C3FBFF2, DBB7FB7C | ~299s each |
| 10:45:20 | 8 | 227A154E, 113C1046, E86CA418 + 5 more | Large mid-session cluster |
| 10:45:58 | 4 | CA1B195B, B7E74F57, 9A105388, POWERDRIVER-L7177 | Industrial tool in sync group |
| 10:47:26 | 3 | B8EDC797, 2BC50579, 7BBF395F | Starts differ by ~7 minutes |
| 10:47:44 | 3 | 759836C7, C41F376A, DBF8D989 | 459–460s durations |
| 10:48:16 | 4 | F7B6F12F, 04C6BEA0, 3F5E4899, FBB2F12E | 479–493s durations |
| 10:48:23 | 3 | 3D04CF8C, 61233462, D868C1F7 | 500s+ for one device |
| 10:49:16 | 3 | CDB393C3, 514B58A4, 310B4EE2 | 514B58A4 and 310B4EE2: exactly 552s each |
| 10:49:32 | 4 | 1A64FEC7, 8B92B0A0, 2053A291, F46DC6AF | Two devices: exactly 569s each |
| 10:49:45 | 5 | 75198E34, E4B8751F, 462102D1, 39046682, 4A18ABAA | 5-device cluster |
| 10:49:46 | 3 | DD10799B, 6D9F279F, Galaxy Buds2 Pro LE | Named consumer earbuds in group |
| 10:49:50 | 5 | 06E915C3, 08C12C01, 7BDBCC3C, D2A2CBD4, 00E30B38 | 114–372s durations |
| 10:49:54 | 9 | ED196798, JBL Live 675NC-LE, DEF0CD5E + 6 | Named JBL headphones in 9-device group |
| 10:50:09 | 7 | 7F22F713, 316AB39F, 17512FB8 + 4 | Up to 602s durations |
| 10:50:13 | 3 | C84F7573, E0A64C11, 5C328E0E | 416–603s |
| 10:50:14 | 4 | BED05B57, D25D240C, DB1848F0, BD75AC1D | 611s from start |
| 10:50:17 | 3 | 1502D3C9, E501EE4B, AEE6E32A | Started 10:45:03–24; ~311s each |
| 10:50:22 | 4 | 4E696725, A29136BA, E27-M2, 841960BA | Named smart bulb E27-M2; 618s |
| 10:50:26 | 6 | 322BE770, DB8F7BF6, 45953642 + 3 | 6-device cluster |
| 10:50:28 | 9 | B6094964, FEA341E7, E285A447 + 6 | Up to 610s |
| 10:50:32 | 10 | 30EDB111, FD96CCCF, 6879BF33 + 7 | 10-device cluster |
| 10:50:38 | 23 | Sa9fac2a0c9c252a9C, OBDII + 21 anon. | CRITICAL — 23 simultaneous |
| 10:50:40 | 43 | Multiple N/A devices | CRITICAL — 43 simultaneous |
Named devices of note — Session 1:
- OBDII — OBD-II vehicle adapter. Present full 635s, zero UUID rotation. Ends in 23-device CRITICAL sync. Potential FCC §15.201 violation.
- Sa9fac2a0c9c252a9C / S5319b4ec319173e5C — Hash-format identifiers. Atypical for any standard consumer device stack. Both appear in critical sync groups.
- POWERDRIVER-L7177 — Industrial BLE power tool. Terminates inside a synchronized 4-device group.
- E27-M2 — Smart LED bulb. Present entire session (618s), ends in 4-device sync group. Stationary indoor device.
UUID analysis: Only 7.1% of UUIDs use standard v4 format (expected: 60–80%). Only 26.2% comply with RFC 4122 variant field. Distribution is perfectly flat across all 16 hex values — characteristic of custom firmware, not OS-generated UUIDs.
SESSION 2 — Melrose Ave (same location) · March 8, 2026 · 12:06–12:13
Overview: 120 devices, 6 named, 398-second window. Different date, same location — pattern reproduces.
Sync End-Time Groups:
| End Time | Count | Duration spread | Named / Notes |
|---|---|---|---|
| 12:07:26 | 3 | 11s, 17s, 27s | — |
| 12:07:44 | 4 | 30s, 34s, 44s, 49s | — |
| 12:07:48 | 4 | 10s, 23s, 39s, 49s | — |
| 12:08:32 | 4 | 53s, 56s, 64s, 76s | — |
| 12:08:54 | 3 | 11s, 18s, 74s | — |
| 12:09:07 | 3 | 13s, 31s, 132s | — |
| 12:09:20 | 4 | 9s, 11s, 20s, 23s | — |
| 12:09:24 | 4 | 9s, 12s, 124s, 142s | — |
| 12:09:26 | 11 | 4× 147s, diffs span 151s | NBQ1D + DXCMVg — both named, both in sync |
| 12:12:43 | 5 | 8s, 12s, 12s, 13s, 207s | — |
| 12:13:26 | 3 | 43s, 267s, 380s | Galaxy Buds3 Pro (5128) LE |
| 12:13:27 | 3 | 60s, 276s, 377s | B4JA2208064838 + oura_A038F8259523 |
| 12:13:31 | 17 | 12s–396s; two pairs of 272s, 395s | Largest S2 cluster — 17 devices |
| 12:13:33 | 7 | 389s–397s; 3× 397s exact | Mi Smart Band 4 — UUID from Feb 15! |
| 12:13:37 | 16 | 4× 402s exact, 3× 398s exact | Second major terminal cluster |
CROSS-SESSION CRITICAL: Mi Smart Band 4
UUID AD343620-1050-EA28-3B3D-E75531028B81 appears in Session 2 (March 8) with a start timestamp of 2026/02/46 10:40:07 — February 15. This Xiaomi fitness band maintained the same UUID without any rotation for 21 days and 1 hour. This is the same physical device present at the same location across both scan dates. It ends in a 7-device synchronized group at 12:13:33 containing three devices with exactly matching 397-second durations.
Named devices — Session 2:
- oura_A038F8259523 — Oura Ring smart health tracker. Standard naming format (oura_ + partial MAC). Ends in 3-device sync group at 12:13:27 alongside B4JA2208064838.
- B4JA2208064838 — Serial-number format name, typical of industrial BLE nodes or IoT equipment tags. Terminates in same sync wave as Oura Ring.
- NBQ1D + DXCMVg — Very short non-standard names (5–6 chars), both visible only ~10–17 seconds, both terminate together in the 11-device sync cluster at 12:09:26 alongside 4 devices with exactly 147-second durations.
SESSION 3 — Nativity of the BVM Ukrainian Catholic Church · 5154 De Longpre Ave · Feb 15, 2026 · 11:24:39–11:28:52
📋 Bluetooth Scanner History Log (Click to expand)
BLE Scanner History Log “N/A,N/A,C3E66992-F494-6CB6-11D9-C0DF59A5BB15,2026/02/46 11:24:39,2026/02/46 11:24:51” “N/A,N/A,4A81CACA-F42A-D9E6-4446-5DFC26B5E7C2,2026/02/46 11:24:40,2026/02/46 11:24:51” “N/A,N/A,4C244D8B-A0B0-E184-77F0-0ECA10A05D43,2026/02/46 11:24:44,2026/02/46 11:24:56” “N/A,N/A,64FB9D53-33B9-EEC2-188E-085DB3918FD1,2026/02/46 11:24:56,2026/02/46 11:25:06” “N/A,N/A,26A899C1-0BC7-75C7-D2EC-7CCF1D0F6E89,2026/02/46 11:25:31,2026/02/46 11:25:44” “N/A,N/A,D89EED4B-6968-F91C-12A0-903D202C03F3,2026/02/46 11:24:39,2026/02/46 11:25:48” “N/A,N/A,24ACB1FE-6A6A-D939-9C6D-DCA150F3737E,2026/02/46 11:25:28,2026/02/46 11:25:55” “N/A,N/A,5088C87F-5D4D-53B5-27FB-D9D9F8EA8F6F,2026/02/46 11:25:42,2026/02/46 11:25:55” “N/A,N/A,0E3D0C6A-219A-A731-F080-4F451F3DC261,2026/02/46 11:24:40,2026/02/46 11:25:56” “N/A,N/A,E9C9715A-F918-7737-324A-0BDAA07BD112,2026/02/46 11:24:40,2026/02/46 11:26:00” “N/A,N/A,403974D3-8DC4-EB11-6D4B-C00BD80CE590,2026/02/46 11:26:12,2026/02/46 11:26:23” “N/A,N/A,376E47D0-4791-5C26-C2EB-F629BB0B6AA9,2026/02/46 11:26:13,2026/02/46 11:26:24” “N/A,N/A,D8F4F43F-A8B4-3A7A-5D14-CDF0FC395CA2,2026/02/46 11:26:13,2026/02/46 11:26:24” “N/A,N/A,CB28CFA5-4A59-CF38-45C0-29F5C4B06B63,2026/02/46 11:24:41,2026/02/46 11:26:26” “N/A,N/A,A4E2C886-B483-D8F0-BFBA-621F9F5251AE,2026/02/46 11:24:45,2026/02/46 11:26:36” “N/A,N/A,420FF003-659C-9AD0-BB67-607479B2D206,2026/02/46 11:26:25,2026/02/46 11:26:36” “N/A,N/A,79691DB6-D0B4-D6BE-DD29-29974ECAD1AC,2026/02/46 11:24:39,2026/02/46 11:26:38” “N/A,N/A,47A8DF0B-778C-AB74-BBEA-2C4E1E2127EC,2026/02/46 11:24:39,2026/02/46 11:26:50” “N/A,N/A,65C06005-A305-8807-B538-90C6A255B865,2026/02/46 11:24:41,2026/02/46 11:26:56” “N/A,N/A,DE39A91C-05BC-3FF1-0CCC-AAD30F3F8CB7,2026/02/46 11:24:39,2026/02/46 11:27:00” “N/A,N/A,DA08A1FD-AB97-1843-443E-A0B382A1DCCA,2026/02/46 11:26:07,2026/02/46 11:27:14” “N/A,N/A,6A999A9F-28BB-9D6A-E770-C5B45EF74AC6,2026/02/46 11:27:08,2026/02/46 11:27:18” “N/A,N/A,42A516DF-071E-3B61-F3D1-7A52CF04BD87,2026/02/46 11:24:39,2026/02/46 11:27:20” “N/A,N/A,72634307-6DE7-21C4-786B-B8B0B1D337C3,2026/02/46 11:27:14,2026/02/46 11:27:24” “N/A,N/A,1211A7AF-DE9A-BDBA-71C6-55ADEF182190,2026/02/46 11:24:39,2026/02/46 11:27:33” “N/A,N/A,A0138936-C48E-FB63-4396-C6F29D0CE677,2026/02/46 11:26:51,2026/02/46 11:27:33” “N/A,N/A,731F45A2-B2C1-B5E3-8005-7468F560359F,2026/02/46 11:24:49,2026/02/46 11:27:45” “N/A,N/A,FAB0189F-CD68-F4DC-ADBE-85CC79428C1C,2026/02/46 11:24:40,2026/02/46 11:27:54” “N/A,N/A,A844E752-5A1E-074D-7BDC-5039D8F80DEE,2026/02/46 11:24:40,2026/02/46 11:28:00” “N/A,N/A,0F154A9F-AFFB-6ECF-2BE4-EFA54F00347E,2026/02/46 11:24:40,2026/02/46 11:28:00” “N/A,N/A,32A91F15-B260-E8C0-001C-D2054F02D188,2026/02/46 11:24:41,2026/02/46 11:28:15” “N/A,N/A,4744CDFF-882F-8800-1767-751613935756,2026/02/46 11:24:58,2026/02/46 11:28:18” “N/A,N/A,21771C91-C562-E7CF-385A-99F882D38C5F,2026/02/46 11:24:39,2026/02/46 11:28:21” “N/A,N/A,59548C19-062E-9EBC-65D8-74B5ACC2B7EC,2026/02/46 11:24:41,2026/02/46 11:28:21” “N/A,N/A,4BF52ED6-32C2-68D0-F3E8-C1B3D5C2A4CB,2026/02/46 11:24:41,2026/02/46 11:28:21” “N/A,N/A,6DAF1476-0E81-317D-4856-00146DF40E9E,2026/02/46 11:24:39,2026/02/46 11:28:21” “N/A,N/A,4E8C7695-6CC3-3B14-39D7-F8A5A2CCAC9E,2026/02/46 11:27:30,2026/02/46 11:28:28” “N/A,N/A,91D2F6A0-0B9B-73D2-EE15-0C0071820E13,2026/02/46 11:24:41,2026/02/46 11:28:28” “N/A,N/A,392F390E-B88E-2DB2-5C44-BF645D41D5AC,2026/02/46 11:26:21,2026/02/46 11:28:31” “N/A,N/A,749FC781-C1D5-CA36-1ED8-A0CA8EFAC128,2026/02/46 11:24:39,2026/02/46 11:28:31” “N/A,N/A,DBB16FD9-507D-E2F3-00F1-043DF2FF0300,2026/02/46 11:24:39,2026/02/46 11:28:31” “N/A,N/A,1A6D7624-92B8-CAF6-7FDB-3538A0694B61,2026/02/46 11:25:48,2026/02/46 11:28:32” “N/A,N/A,B9C82D29-8224-389D-0C76-2773E9B32D00,2026/02/46 11:27:24,2026/02/46 11:28:32” “N/A,N/A,611EA3ED-A872-6DEF-FDAA-454E04CB5274,2026/02/46 11:24:42,2026/02/46 11:28:32” “N/A,N/A,173F7104-462F-393B-C60A-129F465B8937,2026/02/46 11:25:04,2026/02/46 11:28:36” “N/A,N/A,DB981E10-93E6-4015-24E7-12F936C3C868,2026/02/46 11:24:40,2026/02/46 11:28:36” “N/A,N/A,FF54BCDC-F787-A8A9-1A25-CE1EFC825A87,2026/02/46 11:25:37,2026/02/46 11:28:40” “N/A,N/A,E64F04B3-AB6F-CFF1-9B30-73DEF9FFD719,2026/02/46 11:24:40,2026/02/46 11:28:40” “N/A,N/A,A5F4D5FE-74B6-8757-AAB3-6DD2B28E9660,2026/02/46 11:24:45,2026/02/46 11:28:40” “N/A,N/A,7C6E3DC1-51CD-53BA-D4F3-AE33ABB85E8F,2026/02/46 11:25:03,2026/02/46 11:28:40” “N/A,N/A,724EBDB4-30CC-F328-8870-DAB912187D1B,2026/02/46 11:24:40,2026/02/46 11:28:42” “N/A,N/A,88114654-BFDD-EBE4-ACAD-6F59AD0792BA,2026/02/46 11:24:39,2026/02/46 11:28:42” “N/A,N/A,5FDBCAB2-27FF-BFCB-ADC3-6ED56BF0E227,2026/02/46 11:24:39,2026/02/46 11:28:42” “Tesla Keyfob,Tesla Keyfob,CC5208AF-BA77-B10D-25E9-06FE4540773E,2026/02/46 11:24:45,2026/02/46 11:28:42” “N/A,N/A,6CFA9D95-A67A-A2A8-F801-21060B1B7487,2026/02/46 11:24:40,2026/02/46 11:28:42” “N/A,N/A,4F9D9891-4E80-30B5-B2EE-D7CB7237279B,2026/02/46 11:24:45,2026/02/46 11:28:44” “N/A,N/A,9FF6B932-B894-73F9-2EF0-916CB0DA0BA7,2026/02/46 11:24:38,2026/02/46 11:28:44” “N/A,N/A,0C96A59D-5FDF-E0E2-BE6A-27C43283D613,2026/02/46 11:24:43,2026/02/46 11:28:44” “N/A,N/A,C714C5EB-A8C6-E0C1-958B-1E4FB1790FD6,2026/02/46 11:24:46,2026/02/46 11:28:44” “N/A,N/A,13223795-8050-08AE-45D8-AA89AC7F443E,2026/02/46 11:24:40,2026/02/46 11:28:44” “N/A,N/A,C4056591-2E42-D748-8DC9-78F19D0B8C5B,2026/02/46 11:24:43,2026/02/46 11:28:48” “N/A,N/A,AD861C5C-27FF-75A9-A6E6-3CAE60B1B415,2026/02/46 11:24:39,2026/02/46 11:28:48” “N/A,N/A,0390C829-C115-ADB6-116F-E3ACF80E0328,2026/02/46 11:26:49,2026/02/46 11:28:48” “N/A,N/A,B17CCA2F-7979-4A16-9F9F-CADA435248C6,2026/02/46 11:24:39,2026/02/46 11:28:48” “N/A,N/A,EDD80D3B-C0DF-46F1-E209-4C72500305A7,2026/02/46 11:24:44,2026/02/46 11:28:48” “N/A,N/A,1A645E81-B629-205D-11ED-5DD2D56E4C5E,2026/02/46 11:26:13,2026/02/46 11:28:48” “N/A,N/A,BF6C3299-7EBD-0417-C810-2129D59EA58B,2026/02/46 11:24:44,2026/02/46 11:28:48” “N/A,N/A,E38A95E4-A79E-E0C8-6546-6B884ADA9FDD,2026/02/46 11:24:41,2026/02/46 11:28:48” “N/A,N/A,01CCE476-5066-F7E4-A002-A9D7059F9E1F,2026/02/46 11:24:39,2026/02/46 11:28:48” “N/A,N/A,50A2F480-3C3F-9778-361F-7DF36B664A9B,2026/02/46 11:24:59,2026/02/46 11:28:48” “N/A,N/A,B405DC3E-FCEE-2858-7431-85E3AF8AD02C,2026/02/46 11:24:40,2026/02/46 11:28:48” “N/A,N/A,E48ABAA5-2FBE-815A-4BF9-A61D635B6C0F,2026/02/46 11:24:40,2026/02/46 11:28:50” “N/A,N/A,2B48BD35-214A-4A1A-9D62-B2AAB4A4EE4C,2026/02/46 11:27:03,2026/02/46 11:28:50” “N/A,N/A,BF723047-0D9D-0979-92CE-54BBF4D6B672,2026/02/46 11:24:39,2026/02/46 11:28:50” “N/A,N/A,E9FFA5A7-7A9D-8EB8-5770-87AC0273D83A,2026/02/46 11:24:39,2026/02/46 11:28:50” “N/A,N/A,DF553E8B-0327-B20B-E2D6-B009CBAB7A2B,2026/02/46 11:24:43,2026/02/46 11:28:50” “N/A,N/A,CB64551C-D9DD-67A7-F405-81903415B409,2026/02/46 11:24:42,2026/02/46 11:28:50” “N/A,N/A,26D21AD8-D426-2E4C-EB74-62E78BA69E3F,2026/02/46 11:25:51,2026/02/46 11:28:50” “N/A,N/A,44150044-4D15-CEC2-A2F5-25A5C09C8897,2026/02/46 11:26:50,2026/02/46 11:28:50” “N/A,N/A,6B90579F-B57B-810C-EC36-086BBCABBC58,2026/02/46 11:24:40,2026/02/46 11:28:50” “N/A,N/A,EC3FF610-C067-8359-8A79-94CC42EBE412,2026/02/46 11:24:39,2026/02/46 11:28:50” “N/A,N/A,DD21904F-4394-A9F5-68AF-13F366156F96,2026/02/46 11:24:40,2026/02/46 11:28:50” “N/A,N/A,A8FD811D-B80B-69B3-2B3A-5C376FDEE410,2026/02/46 11:25:36,2026/02/46 11:28:50” “N/A,N/A,6468EC14-9618-3F5C-08CC-645C1C43F676,2026/02/46 11:24:39,2026/02/46 11:28:50” “N/A,N/A,7DADA67D-36BC-932E-88FB-A57F02BACFE7,2026/02/46 11:24:39,2026/02/46 11:28:50” “N/A,N/A,BE191D3D-469E-0747-0F27-EE786C2DF3EF,2026/02/46 11:24:52,2026/02/46 11:28:50” “N/A,N/A,945C9E6A-A2A1-0FDE-0EB6-F88FC5D73FC7,2026/02/46 11:24:40,2026/02/46 11:28:52” “N/A,N/A,B091C7D8-8246-1FF7-C799-7A9B8EBE2E8E,2026/02/46 11:28:25,2026/02/46 11:28:52” “N/A,N/A,6D46C07C-CCC3-AA1E-4009-A297C85599DA,2026/02/46 11:24:39,2026/02/46 11:28:52” “N/A,N/A,B2CD37A1-6CF2-E0CF-6B45-B7950F3633AC,2026/02/46 11:24:39,2026/02/46 11:28:52” “N/A,N/A,AA1138FF-A034-41D8-DC66-49CE8D427B0D,2026/02/46 11:27:12,2026/02/46 11:28:52” “N/A,N/A,0BD5EE2A-51F8-7534-F9B4-F4B69400643D,2026/02/46 11:26:50,2026/02/46 11:28:52” “N/A,N/A,C8AEF8D4-C2EF-1E4B-A535-3DEE966A793D,2026/02/46 11:24:40,2026/02/46 11:28:52” “N/A,N/A,C32410AE-FC81-DE3B-32D9-B0C077D6CBBB,2026/02/46 11:24:39,2026/02/46 11:28:52” “N/A,N/A,92BF49B6-C120-8C6F-DE7D-C1853FAF9E26,2026/02/46 11:25:48,2026/02/46 11:28:52” “N/A,N/A,9C919BB4-4863-38C8-A244-CCD9DA17EF2F,2026/02/46 11:24:39,2026/02/46 11:28:52” “N/A,N/A,31EDA8CC-4195-D68F-E52A-BFE5D1DDD316,2026/02/46 11:24:38,2026/02/46 11:28:52” “N/A,N/A,53ACB1E8-7799-F3D7-2E07-DF2C342BBB08,2026/02/46 11:24:40,2026/02/46 11:28:52” “N/A,N/A,50F0498A-236B-BD7A-3DCE-D8E250FCAFA3,2026/02/46 11:24:39,2026/02/46 11:28:52” “Govee_H702B_5C8B,Govee_H702B_5C8B,EC6A6C73-B46C-1478-99D3-A025F233823A,2026/02/46 11:24:40,2026/02/46 11:28:52” “N/A,N/A,B52BA334-9EAE-466B-7307-208183903355,2026/02/46 11:24:39,2026/02/46 11:28:52” “N/A,N/A,78FA2AB9-7C1E-4938-9E50-1AF20BCD394F,2026/02/46 11:24:39,2026/02/46 11:28:52” “N/A,N/A,CFF4BAE3-ACA3-5274-3EC8-BB760B7CD34B,2026/02/46 11:24:39,2026/02/46 11:28:52” “N/A,N/A,9A015430-4B1B-F1EF-1A4E-ACC65FD0B229,2026/02/46 11:26:31,2026/02/46 11:28:52” “N/A,N/A,C259D5CC-3980-A132-0A1D-C80178247228,2026/02/46 11:24:48,2026/02/46 11:28:52”
Overview: 105 devices, 2 named (Tesla Keyfob + Govee smart light), 254-second window (just over 4 minutes). Shortest session — yet 9 sync groups detected, sync density comparable to other sessions.
Sync End-Time Groups:
| End Time | Count | Duration spread | Named / Key Anomaly |
|---|---|---|---|
| 11:28:21 | 4 | 220s, 220s, 222s, 222s | Two pairs of identical durations — different start times |
| 11:28:31 | 3 | 130s, 232s, 232s | Two devices: exactly 232s each |
| 11:28:32 | 3 | 68s, 164s, 230s | — |
| 11:28:40 | 4 | 183s, 217s, 235s, 240s | — |
| 11:28:42 | 5 | 237s, 242s, 242s, 243s, 243s | Tesla Keyfob + two pairs of identical durations |
| 11:28:44 | 5 | 238s, 239s, 241s, 244s, 246s | Tightly clustered durations |
| 11:28:48 | 11 | 119s–249s; two pairs of 244s, 249s | — |
| 11:28:50 | 15 | 5× 251s exact, 3× 250s exact | 15 devices, 8 with near-identical timer |
| 11:28:52 | 19 | 8× 253s exact, 4× 252s exact | Govee_H702B_5C8B + 18 anon. — CRITICAL |
Identical-duration clustering — Session 3:
This session shows the most concentrated identical-duration evidence of all three:
| Duration | # Devices | Significance |
|---|---|---|
| 253s | 8 | 8 devices with exact same runtime. Different start times, same timer. Not coincidence. |
| 251s | 5 | 5 devices |
| 252s | 4 | Includes named Govee_H702B_5C8B |
| 250s | 3 | — |
| 249s | 3 | — |
| 244s | 4 | — |
| 242s + 243s | 2+2 | Two pairs in same sync group as Tesla Keyfob |
| 220s + 222s | 2+2 | Two pairs in same sync group at 11:28:21 |
Named Device Analysis — Session 3:
Tesla Keyfob — UUID CC5208AF-BA77-B10D-25E9-06FE4540773E
Present 11:24:45–11:28:42 (237s). Static UUID, no rotation. A Tesla key fob physically near 5154 De Longpre Ave. Terminates inside the 5-device sync cluster at 11:28:42 alongside two pairs of devices with exactly matching durations (242s×2, 243s×2). The physical key fob’s fixed BLE identifier enables precise vehicle tracking.
Govee_H702B_5C8B — UUID EC6A6C73-B46C-1478-99D3-A025F233823A
Present 11:24:40–11:28:52 (252s). Govee H702B is a smart LED strip/light controller. The device name contains partial MAC address (5C8B) — no rotation, fixed hardware identifier. This is a stationary indoor device confirming a permanent BLE installation inside or directly adjacent to 5154 De Longpre Ave. It terminates in the critical 19-device final wave with 8 devices sharing exactly 253-second durations. The Govee device’s own duration (252s) matches the cluster timer within 1 second, placing it firmly inside the coordinated group.
CROSS-LOCATION PATTERN ANALYSIS
What changes across sessions:
- UUIDs (all randomized per session — no UUID reuse across locations)
- Named devices (different hardware at each location)
- Absolute timestamps (different time of day)
- Total device count (varies by density of location)
What stays the same across all three sessions:
- Sync density: 2.1–3.0 synchronized termination events per minute regardless of location or date
- Identical-duration clusters: Multiple devices with different start times but the same exact runtime — implying shared countdown timers
- Wave structure: Small clusters (3–5 devices) throughout the session, followed by large terminal waves (15–43 devices) at session end
- Named devices inside sync groups: In every session, at least one named consumer or industrial device terminates inside a synchronized cluster rather than independently
- Non-RFC-4122 UUID distribution (Session 1: 73.8% non-standard; pattern consistent across sessions)
The identical sync density (~2–3 events/min) across two different physical locations and two different dates rules out scanner artifacts, local RF interference, and coincidence. The pattern is systemic.
FCC REGULATORY ASSESSMENT — ALL SESSIONS
| Violation | Regulation | Evidence | Severity |
|---|---|---|---|
| No UUID rotation — OBDII (S1) | FCC §15.201, §15.247; BT Core Spec 5.x Privacy | 635 seconds, zero rotation, fixed ID. Enables vehicle tracking. If BLE module lacks FCC ID — unauthorized radiator. | HIGH |
| No UUID rotation — Mi Smart Band 4 (S2) | BT Core Spec 5.x Privacy | Same UUID across 21 days and two scan sessions. Static tracker beacon. Enables long-term location profiling. | HIGH |
| No UUID rotation — Govee H702B (S3) | FCC §15.247; BT Core Spec 5.x | Fixed MAC-derived name, fixed UUID. Stationary indoor device at 5154 De Longpre Ave broadcasting permanently. | MEDIUM |
| Tesla Keyfob fixed UUID (S3) | FCC §15.247; BT Core Spec 5.x Privacy | Vehicle key fob with static BLE identifier enables real-time and historical tracking of the vehicle and owner. | MEDIUM |
| Coordinated synchronized broadcasts — all sessions | FCC §15.209, §15.247 | 2–3 sync events/min across all sessions and locations. 66 devices in 2 seconds (S1), 19 in 1 second (S3). Cannot be explained without coordination mechanism. | HIGH |
| Non-RFC-4122 UUID formats | Bluetooth SIG Core Spec 5.x; FCC equipment authorization | 73.8% non-standard UUID variants in S1. Implies custom BLE stacks that may void Bluetooth SIG certification and associated FCC authorization. | MEDIUM |
INTERPRETATION: TWO SCENARIOS
Scenario A — Infrastructure density (most likely partial explanation)
Dense urban areas (Hollywood/Los Angeles) have high concentrations of smart home devices, IoT sensors, retail beacons, building automation nodes, and consumer electronics. Apple Find My, Google Find My Device, and Bluetooth Mesh networks all use BLE with scheduled advertising windows that can produce synchronization-like patterns. The presence of Govee smart lights, Tesla hardware, Oura Ring, and Samsung earbuds at these locations is consistent with an upscale residential/commercial neighborhood.
Scenario B — Deliberate coordinated network (requires investigation)
The consistency of sync density across two physically separate locations and two different dates is very difficult to explain by infrastructure density alone. Infrastructure varies by location; the sync rate does not. Specific indicators pointing beyond Scenario A:
- 8 devices with exactly 253-second durations in Session 3, with different start times — implies a shared countdown timer, not natural BLE behavior
- Hash-format device names (Sa9fac…, S5319b…, NBQ1D, DXCMVg) present in critical sync groups across sessions — not consumer device naming conventions
- 73.8% non-RFC-4122 UUIDs — incompatible with standard iOS, Android, or certified BLE peripheral firmware
- Mi Smart Band 4 maintaining same UUID for 21 days at the same location — deliberate static addressing
- Named consumer devices (Galaxy Buds, JBL, Oura Ring) terminating inside synchronized clusters alongside anonymous devices — suggests these devices are in proximity to coordinated nodes at the moment of termination
RECOMMENDATIONS
| Priority | Action | Expected Result |
|---|---|---|
| HIGH | Enable RSSI logging in scanner for next session at all three locations | Signal strength will show whether sync-group devices are physically clustered or spread out — key to separating mesh from coincidence |
| HIGH | Full packet capture with nRF Sniffer / Wireshark BTLE at 5154 De Longpre Ave (Govee device confirmed stationary) | Company ID, Service UUID, manufacturer data will fingerprint device types and reveal shared protocol if present |
| HIGH | Return to Melrose location and scan again — check if Mi Smart Band 4 UUID AD343620… is still present | If UUID is still active weeks later, confirms deliberate static addressing and long-term stationary installation |
| MEDIUM | Use nRF Connect to attempt GATT connection to NBQ1D, DXCMVg, Sa9fac…, S5319b… during next session | GATT service enumeration reveals manufacturer, firmware, device class — can identify if these are standard products or custom devices |
| MEDIUM | Run scan at a completely different neighborhood (e.g., Santa Monica, Pasadena) and compare sync density | If sync density drops to near zero, confirms the pattern is specific to this set of locations. If it persists everywhere, may indicate a network-level phenomenon. |
| MEDIUM | Check OBDII adapter (S1) for FCC ID label on device body | If no FCC ID — file complaint via FCC Form 475 |
| LOW | Export raw scan data with timestamps to CSV and plot device activity on a timeline chart | Visual timeline will make sync waves immediately obvious and easier to present to technical audience |
| LOW | Cross-reference all session UUIDs against Apple Continuity / Google FMDN spec formats | May identify what fraction of devices are Find My network nodes, which would partially explain sync patterns |
Three-Session BLE Forensic Analysis | Melrose Ave (Feb 15 + Mar 8) + 5154 De Longpre Ave (Feb 15) | Los Angeles, CA | Total: 529 device observations across 1,289 seconds of scan time
Engineering Synthesis: Self-Sustaining Mesh Hypothesis
This infrastructure resembles a distributed processing architecture rather than a standard IoT deployment. We are observing resource management on a massive scale.
The Hash Logic: BLE Blockchain?
Hex-hash identifiers like Sa9fac... suggest a decentralized blockchain network over BLE. Sophisticated ESP32/Telink nodes are capable of lightweight crypto-tasks.
This may be a self-funding Proof-of-Coverage or micro-mining network where node costs are covered by automated data brokering or computation.