Map Flock Safety ALPR surveillance cameras using WiGLE WiFi data and OUI fingerprinting.
An open-source project that queries the WiGLE crowdsourced WiFi database for networks matching known Flock Safety camera OUI (MAC address) prefixes, then plots them on an interactive map.
Inspired by DeFlock and track-openroaming-passpoint.
| Metric | Value |
|---|---|
| 📸 Cameras Mapped | 146,240 |
| 📡 OUI Prefixes with Data | 31 / 31 |
| 🌎 Countries | 138 |
| 🗺️ Regions | 50 |
| 🕐 Last Updated | 2026-09-18 |
| 📦 Data Retention | 730 days (2 years) |
Stats update automatically after each scan via GitHub Actions.
Warning
Take this map with a grain of salt. WiGLE is a crowdsourced, passively-collected dataset that is updated sporadically on a per-location basis — it is not a live feed. Flock cameras do not broadcast continuously; they wake briefly only to upload data, meaning WiGLE records depend entirely on someone happening to be wardriving in the right place at the right time. Locations may be stale, incomplete, or reflect cameras that have since been moved or removed.
This dashboard is a general awareness tool, not a source of truth. For accurate, real-time, local detection use the hardware devices by STSCollective described below — they implement @NitekryDPaul's actual detection method directly on an ESP32 and can detect Flock cameras as you drive past them. Use discount code FLOCKFINDER at checkout for 20% off your order.
Flock Safety ALPR cameras have WiFi transceivers that periodically wake to upload captured license plate data. These transmissions use MAC addresses with identifiable OUI (Organizationally Unique Identifier) prefixes.
@NitekryDPaul discovered 30 of these OUI prefixes through promiscuous-mode 2.4 GHz analysis. A 31st was contributed by Michael / DeFlockJoplin during field testing in Joplin, MO.
This project:
- Takes those 31 known Flock Safety WiFi OUI prefixes
- Queries the WiGLE WiFi database for networks matching each prefix
- Deduplicates and exports results as GeoJSON + CSV
- Displays camera locations on a dark-themed interactive Leaflet map
Note: WiGLE is a historical, crowdsourced WiFi survey database — it does not use @NitekryDPaul's active detection technique. WiGLE entries are submitted by volunteers wardriving with passive scanners, so coverage is uneven and timestamps may be months or years old. The map is best used as a rough geographic reference, not a definitive or current inventory.
Flock cameras spend most of their duty cycle asleep, waking briefly to upload. The key insight is matching on addr1 (receiver/destination) in addition to addr2 (transmitter) — revealing devices that a transmitter-only sniff would miss.
Combined with wildcard probe request detection (802.11 management frames type=0 subtype=4 with empty SSID), this yields a very tight signature: 11 of 12 cameras caught with only 2 false positives in field testing.
This is the gold-standard detection method — and it requires dedicated hardware running in the field. The WiGLE-based map in this repo does not implement addr1 matching; it can only see what WiGLE volunteers have already passively logged. For real-time, on-the-ground detection using this exact technique, see the STSCollective FlockYou devices — ESP32-based detectors that scan for Flock OUI signatures as you drive, with LED and/or audio alerts the moment a camera is detected. Use discount code
FLOCKFINDERat checkout for 20% off your order.
- Python 3.8+
- A WiGLE account with API credentials
# Clone the repo
git clone https://github.com/simeononsecurity/flock-finder.git
cd flock-finder
# Install dependencies
pip install -r requirements.txt
# Create your .env file with WiGLE credentials (NOT tracked by git)
cp .env.example .env
# Edit .env with your API Name and Token from https://wigle.net/account# Full scan — all 31 OUI prefixes, worldwide
python3 scripts/wigle_query.py
# Single OUI test
python3 scripts/wigle_query.py --oui 70:C9:4E
# US only
python3 scripts/wigle_query.py --country US
# Specific region (bounding box: lat1,lon1,lat2,lon2)
python3 scripts/wigle_query.py --bbox 37,-97,39,-94
# Dry run — verify auth, print OUI list, no API queries
python3 scripts/wigle_query.py --dry-run# Serve the docs directory locally
python3 -m http.server 8080 --directory docs/
# Open in browser
open http://localhost:8080Or just open docs/index.html directly in your browser.
flock-finder/
├── .env # WiGLE API credentials (gitignored)
├── .env.example # Template for .env
├── .gitignore
├── README.md
├── requirements.txt
├── scripts/
│ └── wigle_query.py # WiGLE API query script
├── data/
│ ├── flock_ouis.csv # 31 known Flock Safety OUI prefixes
│ ├── flock_cameras.geojson # Output: camera locations (GeoJSON)
│ ├── flock_cameras.csv # Output: camera locations (CSV)
│ └── scan_stats.json # Output: scan statistics
├── docs/
│ └── index.html # Interactive web map (Leaflet + dark theme)
└── .github/
└── workflows/
└── update-data.yml # GitHub Actions: daily auto-update
31 known prefixes identified by @NitekryDPaul + DeFlockJoplin:
| # | OUI Prefix | Source |
|---|---|---|
| 1 | 70:C9:4E |
@NitekryDPaul |
| 2 | 3C:91:80 |
@NitekryDPaul |
| 3 | D8:F3:BC |
@NitekryDPaul |
| 4 | 80:30:49 |
@NitekryDPaul |
| 5 | B8:35:32 |
@NitekryDPaul |
| 6 | 14:5A:FC |
@NitekryDPaul |
| 7 | 74:4C:A1 |
@NitekryDPaul |
| 8 | 08:3A:88 |
@NitekryDPaul |
| 9 | 9C:2F:9D |
@NitekryDPaul |
| 10 | C0:35:32 |
@NitekryDPaul |
| 11 | 94:08:53 |
@NitekryDPaul |
| 12 | E4:AA:EA |
@NitekryDPaul |
| 13 | F4:6A:DD |
@NitekryDPaul |
| 14 | F8:A2:D6 |
@NitekryDPaul |
| 15 | 24:B2:B9 |
@NitekryDPaul |
| 16 | 00:F4:8D |
@NitekryDPaul |
| 17 | D0:39:57 |
@NitekryDPaul |
| 18 | E8:D0:FC |
@NitekryDPaul |
| 19 | E0:4F:43 |
@NitekryDPaul |
| 20 | B8:1E:A4 |
@NitekryDPaul |
| 21 | 70:08:94 |
@NitekryDPaul |
| 22 | 58:8E:81 |
@NitekryDPaul |
| 23 | EC:1B:BD |
@NitekryDPaul |
| 24 | 3C:71:BF |
@NitekryDPaul |
| 25 | 58:00:E3 |
@NitekryDPaul |
| 26 | 90:35:EA |
@NitekryDPaul |
| 27 | 5C:93:A2 |
@NitekryDPaul |
| 28 | 64:6E:69 |
@NitekryDPaul |
| 29 | 48:27:EA |
@NitekryDPaul |
| 30 | A4:CF:12 |
@NitekryDPaul |
| 31 | 82:6B:F2 |
DeFlockJoplin |
The table below lists the ten most frequently observed SSID values across all WiGLE records matching a known Flock Safety OUI prefix. Because most Flock cameras transmit a hidden SSID (empty broadcast), the entries below represent the minority of records where a network name was visible to the WiGLE wardrive scanner. They are published here as a community reference for researchers and detection tool authors.
⚠️ These SSIDs are not exclusive to Flock cameras. They appear in records whose OUI prefix matches the known Flock Safety list — but many of these network names (e.g.,ClickShare,TEST) are generic and may simply co-occupy the same MAC space. Treat them as correlated observations, not confirmed Flock identifiers.
| # | SSID | Occurrences |
|---|---|---|
| 1 | Flock |
3,259 |
| 2 | SMARTGATE_123456 |
857 |
| 3 | AndroidAP |
316 |
| 4 | TEST |
298 |
| 5 | Compudopt Connect |
219 |
| 6 | ClickShare-Boardroom |
214 |
| 7 | ClickShare |
212 |
| 8 | ClickShare-Conference Room |
137 |
| 9 | Audi HUD |
137 |
| 10 | MAX-PRINTER |
132 |
Computed from 121,099 SSID-bearing records (109,731 unique values) across all 31 OUI files in data/by_oui/. Stats update automatically after each scan.
Filtering for only Flock*-prefixed SSIDs yields 165 unique variants across 3,448 total records. These fall into five distinct patterns:
| Pattern | Unique SSIDs | Records | Description |
|---|---|---|---|
Flock |
1 | 3,259 | Bare name — fully configured / deployed cameras |
Flock-XXXXXX |
151 | 151 | Mixed-case with 6-char uppercase hex suffix |
FLOCK-XXXXXX |
5 | 5 | All-caps variant with 6-char hex suffix |
Flock-XXXX |
1 | 1 | Shorter 4-char hex suffix (Flock-6361) |
FlockXXX |
2 | 2 | Numeric suffix, no dash (Flock001, Flock003) |
| Other | 5 | 30 | Other / non-standard patterns |
The Flock-XXXXXX / FLOCK-XXXXXX naming convention is consistent with camera provisioning SSIDs — each device appears to broadcast a unique hex identifier (likely derived from its MAC address) before being claimed and configured through the Flock Safety platform. Once provisioned, the SSID collapses to the bare Flock name.
This pattern is a strong secondary confirmation signal: observing a
Flock-XXXXXXSSID on a matching OUI prefix is highly indicative of an unconfigured or recently factory-reset Flock Safety camera.
Note
New SSID pattern observed in the wild — Flock Camera net.
A community member (flock-you issue #43) reported a Flock Safety camera broadcasting as Flock Camera net. — a naming format completely invisible to Flock-* pattern searches. The same camera simultaneously broadcast on both 2.4 GHz (channel 1) and 5 GHz (channel 157) using sequential locally administered MACs (e.g. 52:64:CF:9F:A2:DE / :DF). The locally administered addressing is likely a deliberate anti-fingerprinting measure — these MACs will never match IEEE OUI lookups, making SSID-pattern detection the only viable passive identification path for cameras using this scheme.
This section is populated automatically by querying WiGLE for any SSID matching Flock% or FLOCK%, then extracting OUI prefixes from the results that are not in the canonical flock_ouis.csv. Only OUIs observed ≥5 times are reported here to reduce false positives.
No candidate OUI prefixes identified yet — SSID-pattern incremental queries are running. Candidate prefixes will appear here once any novel OUI is observed ≥5 times in Flock-SSID-bearing WiGLE records.
The included workflow runs daily and auto-commits updated camera data:
-
Add your WiGLE credentials as repository secrets:
WIGLE_API_NAME— your API name from wigle.net/accountWIGLE_API_TOKEN— your API token
-
The workflow runs at 6 AM UTC daily, or manually via "Run workflow"
-
If new data is found, it commits updated GeoJSON/CSV/stats automatically
- The
.envfile containing your WiGLE API credentials is gitignored — it will never be committed - For GitHub Actions, credentials are stored as repository secrets (encrypted)
- Never commit API keys to the repository
- OUI Research: @NitekryDPaul — all 30 original OUI prefixes and the promiscuous-mode detection strategy
- Field Testing: DeFlockJoplin — 31st OUI prefix (
82:6B:F2) and wildcard probe tightening - Inspired by: DeFlock (ALPR mapping) and track-openroaming-passpoint (WiGLE data mining)
- Data Source: WiGLE — crowdsourced WiFi/cell network database
- Map: Leaflet + OpenStreetMap
- Data Policy, Provenance & Corrections — every record is suspected (OUI match only), coordinates are published at full precision, and here's how to request a correction.
- Data Dictionary — field-level schema for every file under
data/. - Contributing Guide — local setup, lint/test/validate commands, and how to add an OUI prefix.
⚠️ These are suspected Flock devices, not confirmed. An OUI match is a heuristic — OUIs can be shared, reassigned, or spoofed. Coordinates are published at full precision, exactly as WiGLE reports them. See the Data Policy.
This project uses only publicly available data from the WiGLE database, which aggregates voluntarily contributed WiFi survey data. No hacking, unauthorized access, or proprietary systems are involved.
The goal is transparency — communities have a right to know where surveillance infrastructure is deployed in their neighborhoods.
MIT License — see LICENSE for details.