Sarai Hannah Ajai Shares her Legal-Professional Installation and Activation Instructions for Verizon Orbic RC400L Rayhunter (StingRay devices and other)
Legal-Professional Installation and Activation Instructions for Verizon Orbic RC400L Rayhunter
Subject: Installation, Activation, Verification, and Apple Device Connection Procedure for Verizon Orbic RC400L Running EFForg/Rayhunter
Prepared For: Sarai Hannah Ajai
Monitoring Device: Verizon Orbic RC400L Mobile Hotspot
Security Software: EFForg/Rayhunter
Computer Used for Installation: Apple Mac Mini M1
Connected Apple Devices: Apple Mac Mini M1; Apple iPhone 17, 16, 15, 14
Purpose: Personal cybersecurity monitoring, cellular-security review, device-connection reconciliation, and preservation of technical evidence.
1. Purpose of the Rayhunter Installation
I installed EFForg/Rayhunter on a Verizon Orbic RC400L mobile hotspot for the lawful purpose of personal cybersecurity monitoring and technical evidence preservation. Rayhunter is an open-source tool created by the Electronic Frontier Foundation to assist with detecting IMSI catchers, also known as cell-site simulators or stingray-type surveillance devices. The EFF Rayhunter project states that Rayhunter was first designed to run on the Orbic RC400L mobile hotspot, and the Rayhunter supported-device documentation states that Rayhunter was built and tested primarily on the Orbic RC400L. (GitHub)
The Verizon Orbic RC400L was used as a dedicated monitoring device because it operates separately from my Apple iPhone 17 and Apple Mac Mini M1. This separation allows the Orbic to serve as an independent cellular-security reference point. The Rayhunter installation was not performed for improper monitoring of other persons. It was installed on a self-owned device to observe the cellular behavior of the Orbic hotspot, review Rayhunter warning results, preserve recordings when needed, and document network-device connection counts during controlled testing.
2. Required Materials
The following materials were required for installation and verification:
Item | Purpose |
Verizon Orbic RC400L mobile hotspot | Device on which Rayhunter runs |
Apple Mac Mini M1 | Computer used to download and install Rayhunter |
Orbic Wi-Fi password | Used to connect Apple devices to Orbic Wi-Fi |
Orbic admin password | Used for Orbic admin login and Rayhunter installation |
Rayhunter macOS ARM release package | Correct Rayhunter package for Apple Silicon/M1 |
USB cable | Optional; used for charging or possible USB access |
Browser | Used to access Orbic admin page and Rayhunter dashboard |
For an Apple Mac Mini M1, the correct Rayhunter release package is the macOS ARM package, because Apple Silicon Macs use ARM architecture. The Rayhunter installation documentation lists macos-arm as the correct package for M1/M2-style Macs. (Electronic Frontier Foundation)
3. Downloading the Correct Rayhunter Package
From the official EFForg/Rayhunter release page, I selected the Rayhunter release package for macOS ARM.
The correct file name used for the installation was:
rayhunter-v0.10.2-macos-arm.zip
The following files were not selected for the Apple Mac Mini M1 installation:
File Type | Reason Not Used |
macos-intel.zip | Intended for Intel-based Macs |
linux-aarch64.zip | Intended for Linux ARM64 systems |
linux-x64.zip | Intended for Linux Intel/AMD systems |
.sha256 files | Checksum files, not the installer package |
Source code ZIP/TAR files | Developer source package, not the ready-to-run release package |
If Safari automatically extracted the ZIP file, the Downloads folder showed the extracted folder instead of the ZIP file. In this case, the correct extracted folder was:
rayhunter-v0.10.2-macos-arm
4. Opening Terminal and Confirming the Installer
On the Apple Mac Mini M1, I opened Terminal and entered the extracted Rayhunter folder:
cd ~/Downloads/rayhunter-v0.10.2-macos-arm
I confirmed that the installer file existed by running:
pwd
ls -lah installer
The expected file was:
installer
The installer file was present in the extracted Rayhunter folder.
5. Allowing the Installer to Run on macOS
Before running the installer, I used the macOS permission command recommended for the Rayhunter installer:
xattr -d com.apple.quarantine installer
If macOS returned the following result, it was not treated as an installation failure:
No such xattr: com.apple.quarantine
That message only means macOS did not place the quarantine flag on the installer.
I then ensured the installer was executable:
chmod +x installer
The Rayhunter installation documentation includes the macOS xattr step before running the installer. (Electronic Frontier Foundation)
6. Connecting the Apple Mac Mini M1 to the Verizon Orbic RC400L Wi-Fi
Before running the Rayhunter installer, I connected the Apple Mac Mini M1 to the Verizon Orbic RC400L Wi-Fi network.
The correct connection sequence was:
- Power on the Verizon Orbic RC400L.
- Open the Mac Wi-Fi menu.
- Disconnect from the normal NETGEAR/home Wi-Fi network.
- Select the Orbic / Verizon / RC400L Wi-Fi network.
- Enter the Orbic Wi-Fi password.
- Confirm the Mac was connected to the Orbic Wi-Fi network.
This step is important because both the NETGEAR router and Orbic hotspot may use the same local router address:
192.168.1.1
If the Mac is connected to the NETGEAR Wi-Fi, opening 192.168.1.1 may display the NETGEAR admin page instead of the Orbic admin page. Therefore, the Mac must be connected to the Orbic Wi-Fi before installing Rayhunter or accessing the Orbic admin interface.
7. Confirming the Orbic Admin Page
After connecting the Mac Mini to the Orbic Wi-Fi, I opened the Orbic admin page in a browser:
The page must show the Orbic hotspot admin portal, not the NETGEAR router page.
The Rayhunter installation documentation states that a user knows the device is connected correctly when the Orbic admin page is reachable at 192.168.1.1. The same documentation explains that for Verizon Orbic devices, the installer uses the password for the Orbic admin menu, and the default admin password is usually the Wi-Fi password unless changed. (Electronic Frontier Foundation)
8. Important Password Distinction
During the setup, I confirmed that there are two separate password categories:
Password | Used For |
Orbic Wi-Fi password | Connecting Apple iPhone 17 and Mac Mini M1 to the Orbic Wi-Fi |
Orbic admin password | Logging into the Orbic admin portal and running the Rayhunter installer |
These two passwords may be the same by default, but they may also differ if either password was changed. This distinction became important when the Apple iPhone 17 initially returned an incorrect password message. The issue was resolved by confirming the correct Wi-Fi password and reconnecting the iPhone to the Orbic Wi-Fi network.
No password should be included in screenshots, written reports, GitHub records, legal filings, or shared messages.
9. Installing Rayhunter on the Verizon Orbic RC400L
After confirming that the Mac Mini was connected to the Orbic Wi-Fi and that the installer file was present, I ran the Rayhunter Orbic installation command from inside the Rayhunter folder:
./installer orbic --admin-password 'YOUR_ORBIC_ADMIN_PASSWORD'
The real Orbic admin password was entered locally in Terminal and should not be disclosed in any report.
If the Orbic admin username had been changed from the default, the installer command could include the username:
./installer orbic --admin-username 'admin' --admin-password 'YOUR_ORBIC_ADMIN_PASSWORD'
If the Orbic admin IP address had been changed from the default, the installer command could include the admin IP address:
./installer orbic --admin-ip '192.168.1.1' --admin-username 'admin' --admin-password 'YOUR_ORBIC_ADMIN_PASSWORD'
The Rayhunter installation documentation identifies the Orbic installation command and explains that changed username, password, or IP settings must be provided to the installer. (Electronic Frontier Foundation)
10. Activating and Verifying Rayhunter
After the installer completed, the Orbic restarted and Rayhunter became active. The Rayhunter installation was verified through two main indicators:
Verification Item | Result |
Green bar on Orbic display | Confirmed Rayhunter was running |
Rayhunter dashboard in browser | Confirmed Rayhunter web interface was active |
The Rayhunter dashboard was accessed through the Orbic Wi-Fi network at:
The Rayhunter documentation explains that the Orbic web UI can be accessed at 192.168.1.1:8080 after installation and that the interface provides access to recordings, downloads, and analysis results. (Electronic Frontier Foundation)
11. Rayhunter Dashboard Verification
Once the dashboard loaded, I verified the following:
Dashboard Field | Verification Purpose |
Rayhunter Version | Confirms installed software version |
Current Recording | Confirms Rayhunter is recording |
Recording ID | Identifies a specific recording session |
Start Time | Documents when the recording began |
Last Message | Documents the latest recorded modem message |
Warning Count | Shows whether Rayhunter identified warning results |
History | Shows prior recordings |
PCAP / QMDL / ZIP downloads | Allows preservation of recording files |
Battery / Storage / Memory | Confirms device operating condition |
The dashboard showed Rayhunter version 0.10.2, active recordings, historical recordings, available downloads, and warning results. The reviewed recordings displayed 0 warnings. The expanded Rayhunter analysis stated “No warnings to display” for the reviewed capture.
12. Expanding Rayhunter Analysis Results
To review the details of a recording, I clicked the dropdown arrow beside the 0 warnings analysis label.
The expanded analysis showed:
Analysis Detail | Meaning |
No warnings to display | No Rayhunter warning was identified for that recording |
Analysis by Rayhunter version 0.10.2 | Confirms analysis software version |
Device system OS: Linux 3.18.48 | Identifies the Orbic internal system environment |
Analyzer list | Shows the types of checks applied to the recording |
The listed analyzers included checks for suspicious identity requests, downgrade behavior, null cipher behavior, incomplete SIB behavior, NAS null cipher behavior, and diagnostic cellular messages. Rayhunter’s heuristic documentation describes analyzers for potential IMSI-catcher behavior, including identity requests, downgrade behavior, null cipher behavior, incomplete SIB indicators, and diagnostic review. (Electronic Frontier Foundation)
A result of 0 warnings does not prove that no security issue exists anywhere. It only means that the specific Orbic cellular recording did not produce Rayhunter warnings under the enabled analyzers. Rayhunter monitors the Orbic hotspot’s cellular modem behavior, not the internal cellular modem of the Apple iPhone 17.
13. Connecting the Apple iPhone 17 to the Orbic Rayhunter Wi-Fi
To connect the Apple iPhone 17:
- Open Settings on the iPhone.
- Open Wi-Fi.
- Select the Verizon Orbic RC400L Wi-Fi network.
- Enter the Orbic Wi-Fi password, not the Rayhunter installer command and not necessarily the admin password.
- Confirm the iPhone shows a checkmark beside the Orbic Wi-Fi network.
- Open Safari on the iPhone.
- Enter:
After successful connection, the iPhone could view the Rayhunter dashboard. The iPhone acted as a Wi-Fi client and dashboard viewer. It did not become the device Rayhunter directly monitors at the cellular modem level.
If the iPhone shows Incorrect Password, the recommended correction is:
- Tap the information icon beside the Orbic network.
- Select Forget This Network.
- Confirm the actual Orbic Wi-Fi password through the Orbic admin portal or device display.
- Rejoin the Orbic Wi-Fi using the correct Wi-Fi password.
14. Connecting the Apple Mac Mini M1 to the Orbic Rayhunter Wi-Fi
To connect the Mac Mini M1:
- Open the macOS Wi-Fi menu.
- Select the Verizon Orbic RC400L Wi-Fi network.
- Enter the Orbic Wi-Fi password.
- Open a browser.
- Enter:
The Mac Mini M1 can view the Rayhunter dashboard when connected to the Orbic Wi-Fi. If the Mac Mini is connected to the NETGEAR router instead, the Rayhunter dashboard may not open because the NETGEAR router may also use 192.168.1.1.
15. Apple Device Connection Reconciliation
After Rayhunter was installed and the Apple devices were connected, I reviewed the Orbic connected-device count. The controlled test eventually confirmed the following expected baseline:
Test Condition | Expected Count | Observed Count | Interpretation |
No Apple devices connected | 0 | 0 | Normal baseline |
Apple iPhone 17 only connected | 1 | 1 | Normal iPhone-only connection |
Apple Mac Mini M1 only connected | 1 | To be verified if needed | Expected normal result |
Apple iPhone 17 and Mac Mini M1 connected | 2 | 2 | Normal two-device connection |
During earlier testing, an initial device-count discrepancy appeared. At one point, the Orbic appeared to show more connected devices than expected. After confirming the correct Wi-Fi password and reconnecting the Apple iPhone 17 and Apple Mac Mini M1 under controlled conditions, the device count matched the known devices. The corrected baseline showed that the iPhone-only connection displayed one connected device and the iPhone-plus-Mac connection displayed two connected devices.
The earlier discrepancy should remain documented as a technical observation, but the later controlled test reduced the immediate concern of an unknown active Wi-Fi client.
16. Optional USB / ADB Access Attempt
I also attempted to prepare the Apple Mac Mini M1 for USB access to Rayhunter by installing Android Platform Tools through Homebrew. Although the package name references Android, it installs the adb tool on macOS.
The command used was:
brew install --cask android-platform-tools
The installation was verified by running:
adb version
The Mac reported that ADB was installed and running on Darwin ARM64. However, when attempting USB forwarding:
adb forward tcp:8080 tcp:8080
ADB returned:
adb: no devices/emulators found
This means the Mac did not detect the Orbic as an ADB USB device at that time. This did not affect the working Rayhunter Wi-Fi dashboard. The Rayhunter installation remained functional through Orbic Wi-Fi at:
The USB method remains optional. It is not required for ordinary Rayhunter dashboard access when the Mac or iPhone is connected directly to the Orbic Wi-Fi.
17. Optional Configuration Review
The Rayhunter dashboard includes a Configuration section. The configuration area may include settings such as device UI behavior, notification options, analyzer settings, and Wi-Fi client mode. Rayhunter documentation describes configuration options available through the web interface, including device display behavior, notification configuration, analyzer settings, and Wi-Fi client mode. (Electronic Frontier Foundation)
The most useful optional configuration for my setup may be Wi-Fi Client Mode, if available and stable. Wi-Fi Client Mode may allow the Orbic to connect to the NETGEAR network while still keeping the Rayhunter dashboard accessible from a device on the same network. This could reduce the need to disconnect the Mac Mini from NETGEAR Wi-Fi just to view the Rayhunter dashboard.
However, analyzer settings should not be changed without a clear reason, because changing analyzer settings may affect the consistency of future Rayhunter warning results.
18. Evidence Preservation Procedure
For documentation purposes, the following evidence should be preserved:
Evidence Item | Purpose |
Screenshot of Rayhunter dashboard | Shows Rayhunter active and recording |
Screenshot of green bar on Orbic display | Shows Rayhunter running on the device |
Screenshot of expanded analysis dropdown | Shows warning count and analyzer details |
Screenshot of Orbic connected-device list | Shows device-count reconciliation |
Recording ZIP files | Preserves Rayhunter capture data |
PCAP and QMDL files | Preserves technical capture formats |
Date/time notes | Provides chronological record |
Device-count reconciliation table | Shows expected vs. observed device count |
Router context notes | Identifies whether Mac was on Orbic or NETGEAR |
Password-change notes | Documents later security cleanup without disclosing passwords |
Recommended file naming format:
Rayhunter_Recording_[RecordingID]_[YYYY-MM-DD]_[WarningStatus].zip
Example:
Rayhunter_Recording_1778189388_2026-05-07_ZeroWarnings.zip
19. Security Cleanup
After installation and connection testing, the following security steps are recommended:
- Change the Orbic Wi-Fi password.
- Change the Orbic admin password, if the Orbic admin portal allows it.
- Save the new password only in a secure password manager or private written record.
- Do not include the password in screenshots or legal exhibits.
- Reconnect only known devices.
- Reconfirm the device-count baseline:
- no devices connected = 0,
- iPhone only = 1,
- Mac only = 1,
- iPhone plus Mac = 2.
This creates a cleaner future baseline for any later device-count review.
20. Legal-Professional Summary Statement
The Verizon Orbic RC400L Rayhunter installation was completed for lawful personal cybersecurity monitoring and technical evidence preservation. The Orbic RC400L was selected because Rayhunter was first designed for and primarily tested on the Orbic RC400L device. The Apple Mac Mini M1 was used to install Rayhunter using the macOS ARM release package. After installation, the Orbic displayed the green Rayhunter status bar, and the Rayhunter dashboard became accessible through the Orbic Wi-Fi network at the local Rayhunter web interface.
The Apple iPhone 17 and Apple Mac Mini M1 were later connected to the Orbic Wi-Fi network to view the Rayhunter dashboard and to test connected-device counts. After correcting the Wi-Fi password issue and reconnecting the devices under controlled conditions, the Orbic connected-device count matched the expected number of known Apple devices. The iPhone-only connection showed one connected device, and the iPhone-plus-Mac connection showed two connected devices.
Rayhunter recordings were active, available for download, and showed 0 warnings in the reviewed expanded analysis. This means Rayhunter did not identify warning results in the reviewed Orbic cellular recordings. The result is useful evidence that Rayhunter was operating and applying its analyzers, but it should not be overstated as a complete forensic conclusion regarding all possible device-security concerns.
Quick Installation Command Reference
Use these commands only from inside the extracted Rayhunter macOS ARM folder:
cd ~/Downloads/rayhunter-v0.10.2-macos-arm
xattr -d com.apple.quarantine installer
chmod +x installer
./installer orbic --admin-password 'YOUR_ORBIC_ADMIN_PASSWORD'
Then open the Rayhunter dashboard while connected to the Orbic Wi-Fi:
For iPhone or Mac connection, use the Orbic Wi-Fi password to join the Orbic network, then open the same dashboard address in Safari or Chrome.
The Verizon Orbic RC400L mobile hotspot may be purchased through authorized carrier channels, including Verizon when available, or through third-party resale marketplaces such as eBay. When purchased through Verizon, the device is sold as an Orbic Speed Mobile Hotspot and may require separate service activation or a data plan depending on the user’s intended use. When purchased through eBay or another resale marketplace, the device may be listed as a used, refurbished, open-box, or preconfigured Orbic RC400L unit. Some third-party sellers may advertise the device with Rayhunter already installed; however, Rayhunter is open-source software developed by EFForg and is not a Verizon-branded product. For documentation purposes, the device should be described as a Verizon Orbic RC400L mobile hotspot running EFForg/Rayhunter, rather than as an official “Verizon Rayhunter” device.
Average Cost Research
Based on current public listings I found:
Source | Current Price Evidence | Practical Cost Estimate |
Verizon Store / Verizon official listing | Verizon lists the Orbic Speed Mobile Hotspot at $49.99 full retail price, with a possible $40 activation fee per device if activated through Verizon. (Verizon) | About $49.99 device-only, or about $89.99 before taxes/fees if the activation fee applies. |
eBay — standard Orbic RC400L units | Search results show examples around $21.95 + shipping, $22.99, $24.99, $37.00 + shipping, and $49.00 + shipping for used/refurbished/open-box Orbic Speed RC400L units. (eBay) | Usually about $25–$50, depending on condition, shipping, SIM, battery, and seller. |
eBay — Rayhunter-preinstalled listings | I found third-party listings advertising Rayhunter/IMSI-catcher detector Orbic RC400L devices at prices such as $29.89 pre-owned and $95.00 new/preconfigured. (eBay) | Usually about $30–$95, depending on whether Rayhunter is preinstalled and whether the unit includes battery, SIM, accessories, and seller support. |
Orbic manufacturer site / related hotspot pricing | Orbic’s own hotspot page lists an Orbic Speed 4G Mobile Hotspot at $79.00, while other newer Orbic 5G hotspot models are higher. (Orbic) | Around $79 for a 4G Orbic hotspot from Orbic’s site, but confirm model compatibility before purchase. |
Comments
Post a Comment