Sarai Hannah Ajai Legal-Professional Statement of Technical Security Purpose and Device-Count Discrepancy - Verizon Orbic RC400L Rayhunter's GitHub app
Legal-Professional Statement of Technical Security Purpose and Device-Count Discrepancy
Subject: Purchase, Installation, and Use of Verizon Orbic RC400L with EFForg/Rayhunter for Cellular Security Monitoring and Documentation of Device-Connection Discrepancies
Reporting Party: Sarai Hannah Ajai
Device Used for Monitoring: Verizon Orbic RC400L Mobile Hotspot
Software Installed: EFForg/Rayhunter, Version 0.10.2
Related Personal Devices: Apple iPhone 17; Apple Mac Mini M1
Location: Fargo, North Dakota
Date of Initial Installation and Review: May 6, 2026
I, Sarai Hannah Ajai, prepared this statement to document the reason I purchased, installed, and used a Verizon Orbic RC400L mobile hotspot with the EFForg/Rayhunter (Stingray and other) software package for personal cellular-security monitoring, technical review, and evidence-preservation purposes. Rayhunter is an open-source project developed to detect IMSI catchers, also known as cell-site simulators or stingray-type surveillance devices, and the EFForg/Rayhunter project states that it was first designed to run on the Orbic RC400L mobile hotspot. (GitHub)
My purpose in purchasing and installing the Verizon Orbic RC400L with Rayhunter was to create an independent, dedicated monitoring device that could provide a separate technical reference point from my personal Apple devices, including my Apple iPhone 17 and Apple Mac Mini M1. I installed the device for personal cybersecurity review, cellular-network anomaly monitoring, device-connection verification, and documentation of suspected unauthorized interference, including concerns involving possible device cloning, mirroring, unauthorized access, or other computer-security interference affecting my Apple iPhone 17.
The Verizon Orbic RC400L was selected because Rayhunter documentation identifies the Orbic RC400L as the device on which Rayhunter was primarily built and tested, and the Orbic/Kajeet RC400L documentation page describes the RC400L as the original device for which Rayhunter was developed. (Electronic Frontier Foundation) This made the Orbic RC400L an appropriate device for my intended security-monitoring use because it could operate separately from my iPhone and Mac Mini while running the Rayhunter monitoring software.
On or about May 6, 2026, I installed Rayhunter version 0.10.2 on the Verizon Orbic RC400L using my Apple Mac Mini M1 and the Rayhunter macOS ARM installation package. After installation, the Orbic displayed the expected green bar, and the Rayhunter web dashboard became available through the Orbic Wi-Fi network at the local Rayhunter interface. EFF’s Rayhunter installation documentation states that after installation, Rayhunter can be verified through its web UI and by a green line flashing along the top of the device display. (Electronic Frontier Foundation) EFF’s public Rayhunter explanation further states that a green or blue line indicates Rayhunter is running with no suspicious event shown, while a red line indicates that Rayhunter logged a suspicious event. (Electronic Frontier Foundation)
After installation, I connected my Apple Mac Mini M1 and Apple iPhone 17 to the Verizon Orbic RC400L Wi-Fi network. While reviewing the Orbic connected-device count, I observed a discrepancy. When both known devices were connected, the Orbic reported three connected devices, even though I expected only two known devices to be connected. Because I have ongoing concerns about possible unauthorized cloning, mirroring, or compromise of my Apple iPhone 17, I elected to treat this discrepancy as a potential compromise indicator requiring controlled review and documentation.
I then performed a basic device-count reconciliation test by connecting and disconnecting known devices from the Verizon Orbic RC400L Wi-Fi network. The purpose of this reconciliation was to determine whether the reported connected-device count corresponded with the number of devices I intentionally connected. Verizon’s Orbic Speed user guide states that the hotspot web UI can display connected clients, including devices connected by Wi-Fi and tethered devices, and can show name, MAC address, and IP address. (Verizon Wireless) The table below documents the sequence of my test, the expected number of connected devices, the actual number reported by the Orbic device, and the preliminary interpretation of each result.
Device-Count Reconciliation Table for Verizon Orbic RC400L Rayhunter Wi-Fi Connection Review
| Step | Test Action | Known Devices Intentionally Connected | Expected Device Count | Actual Orbic Device Count | Preliminary Interpretation |
|---|---|---|---|---|---|
| 1 | Apple Mac Mini M1 and Apple iPhone 17 connected to Orbic Wi-Fi | Mac Mini M1; iPhone 17 | 2 | 3 | Device-count discrepancy observed. Further review required. |
| 2 | Apple Mac Mini M1 disconnected from Orbic Wi-Fi | iPhone 17 only | 1 | 2 | Mac Mini was counted as one device, but one additional count remained while the iPhone was connected. |
| 3 | Apple iPhone 17 disconnected from Orbic Wi-Fi | None | 0 | 0 | No unknown device remained connected after both known devices were disconnected. |
| 4 | Apple iPhone 17 reconnected to Orbic Wi-Fi by itself | iPhone 17 only | 1 | 2 | Discrepancy repeated when the iPhone 17 alone was connected. This supports further review of iPhone-related network identification behavior. |
The reconciliation table shows that the connected-device count returned to zero after both known devices were disconnected, which indicates that no additional device remained actively connected to the Orbic Wi-Fi network at that moment. However, the device count returned to two when the Apple iPhone 17 alone was reconnected. Because this repeated discrepancy was associated with the iPhone 17 connection event, I am documenting it as a potential compromise indicator or device-identification anomaly requiring further technical review.
At this stage, I am not stating that the device-count discrepancy conclusively proves cloning, mirroring, unauthorized access, or computer intrusion. The discrepancy may have a technical explanation, including Apple private Wi-Fi addressing, a temporary client entry, device-name mismatch, stale DHCP lease behavior, tethered-device reporting, shared Apple ecosystem Wi-Fi access by another authorized device, or another network-identification issue. However, because the count repeatedly showed two connected devices when only the iPhone 17 was intentionally reconnected, I consider the discrepancy serious enough to justify continued documentation, password changes, screenshot preservation, device-list review, and additional technical verification.
The Verizon Orbic RC400L Rayhunter installation was not purchased or installed for improper monitoring of other persons. It was purchased and installed as a self-owned personal security device for observing the cellular behavior of the Orbic hotspot, reviewing whether Rayhunter logs suspicious cellular events, accessing the Rayhunter dashboard, preserving downloadable capture data if needed, and maintaining an independent technical record in connection with my ongoing concerns about unauthorized access to my Apple devices.
The relevant technical findings currently documented are as follows: Rayhunter successfully installed on the Verizon Orbic RC400L; the green bar appeared on the Orbic display; the Rayhunter web dashboard became accessible through the Orbic Wi-Fi network; the Apple Mac Mini M1 and Apple iPhone 17 were connected to the Orbic Wi-Fi network; the Orbic showed three connected devices when two known devices were expected; the count dropped to two after the Mac Mini disconnected; the count dropped to zero after the iPhone disconnected; and the count returned to two after the iPhone 17 alone was reconnected. These findings are being preserved as a technical-security concern and not as a final forensic conclusion.
For evidence-preservation purposes, I intend to maintain screenshots of the Rayhunter dashboard, screenshots of the Orbic connected-device page, notes showing the date and time of each connection-count change, and any available device identifiers such as local IP addresses, device names, Wi-Fi addresses, and MAC addresses. Any such information will be handled as sensitive technical information. I also intend to change the Orbic Wi-Fi and administrator password, reconnect only known devices, and repeat the same device-count test to determine whether the discrepancy continues after a clean password change and controlled reconnection process.
This statement is prepared to explain the lawful, security-related reason for purchasing and installing the Verizon Orbic RC400L Rayhunter device and to document the device-count discrepancy observed during initial monitoring. The present concern is best described as a potential compromise indicator involving device-count inconsistencies associated with the Apple iPhone 17 connection to the Orbic Wi-Fi network. Further review is needed before any final conclusion can be made regarding cloning, mirroring, unauthorized access, or other computer-security interference.
Recommended Evidence Items to Attach
Screenshot showing the Rayhunter dashboard running at the local Rayhunter interface.
Screenshot showing the green bar on the Verizon Orbic RC400L.
Screenshot showing three connected devices when the Mac Mini M1 and iPhone 17 are connected.
Screenshot after disconnecting the Mac Mini M1 showing two devices.
Screenshot after disconnecting the iPhone 17 showing zero devices.
Screenshot after reconnecting only the iPhone 17 showing two devices.
Notes showing the date, time, and sequence of each test.
Orbic connected-device details showing device name, IP address, MAC/Wi-Fi address, and connection type, with passwords hidden.
Rayhunter downloaded capture files, if later needed for technical review.
A written note confirming any later Orbic Wi-Fi/admin password change and the results of the retest after password change.
Comments
Post a Comment