Home > Features > Bluetooth Scanning & Detection

Bluetooth Scanning & Detection

Biscuit includes a suite of specialized Bluetooth scanners, each tuned to detect specific types of devices. All scanning modes are found under the Bluetooth tab in the Scanning section.

To start any scan: open the app, navigate to Bluetooth > Scanning, and select the mode you want.

Bluetooth Scan

General-purpose BLE device discovery. This mode scans for all nearby Bluetooth Low Energy devices and displays everything it finds.

How to start: Bluetooth > Scanning > Bluetooth Scan

What you see: A scrollable list of detected devices. Each entry shows:

  • Device name (if the device is broadcasting one, otherwise shown as “Unknown”)
  • MAC address
  • Signal strength (RSSI) in dBm
  • Device type based on advertised services (e.g., audio, wearable, computer, phone)
  • Vendor – The manufacturer identified from the MAC address OUI database

Filtering and sorting: You can sort results by signal strength, name, or device type. A search bar lets you filter by name or MAC address.

This is the broadest scan mode and a good starting point when you want to see what BLE devices are active in your area. Results update in real time as devices appear, disappear, or change signal strength.

Tips:

  • From the scan results, tap the Foxhunt icon on any device card to switch into Foxhunt mode and track that specific device by signal strength.
  • The vendor name (shown below the MAC address) can help you identify what a device is even when it does not broadcast a name.
  • BLE devices rotate their MAC addresses periodically for privacy. You may see the same physical device appear with different addresses over time.

AirTag Detection

A specialized scanner for Apple AirTags and Find My network accessories. This mode filters for the specific BLE advertisement patterns used by Apple’s tracking ecosystem.

How to start: Bluetooth > Scanning > AirTag Detection

What you see: A list of detected AirTags, each showing:

  • MAC address
  • Signal strength (RSSI)

Tips:

  • You can save any detected AirTag with a custom name for ongoing tracking and later use with the AirTag Spoof attack.
  • This is particularly useful for detecting unwanted tracking devices. If you suspect someone has placed an AirTag on your belongings, vehicle, or bag, this scanner will reveal it.
  • AirTags rotate their MAC address roughly every 15 minutes, but the detection algorithm accounts for this by matching on advertisement payload patterns rather than MAC alone.

Flipper Zero Detection

Detects nearby Flipper Zero multi-tool devices. The Flipper Zero broadcasts characteristic BLE advertisements that this scanner identifies and flags.

How to start: Bluetooth > Scanning > Flipper Zero

What you see: A list of detected Flipper devices, each showing:

  • Device name
  • MAC address
  • Signal strength (RSSI)

Tips:

  • The Flipper Zero uses a distinctive BLE advertisement pattern that makes it identifiable even when its Bluetooth name has been changed.
  • This is useful for security awareness in environments where Flipper devices may be used for unauthorized testing.

Flock Camera Detection

Detects Flock Safety automated license plate reader (ALPR) cameras. These surveillance cameras are commonly mounted on poles, signs, or vehicles and are used to capture and log license plates.

How to start: Bluetooth > Scanning > Flock Camera

What you see: A list of detected cameras, each showing:

  • Device name (or the camera’s serial number if no name is advertised)
  • MAC address
  • Signal strength (RSSI)
  • Serial number
  • Detection method – a short tag (MFR, OUI, NAME, WPROBE, SOUI, SNAME, WADDR2, WADDR1) showing how the camera was identified, in decreasing order of confidence. WPROBE means a wardrive or Flock-hunt session caught the camera’s WiFi probe (a high-confidence WiFi-side hit). WADDR2/WADDR1 are suspected WiFi-side hits based on the camera’s WiFi MAC prefix. SNAME means the device only advertised a 10-digit serial number — common to Flock hardware but not unique to it, so treat as a suspected hit.

Tips:

  • Flock cameras are often found in residential neighborhoods, commercial areas, and along major roads.
  • Detection range is typically shorter than for other BLE devices, as Flock cameras use low-power BLE advertisements.

Skimmer Detection

Scans for Bluetooth-enabled credit card skimmers. Criminals attach skimming devices to ATMs, gas pumps, and point-of-sale terminals to steal card data. Many of these skimmers use HC-05 or HC-06 Bluetooth modules to wirelessly transmit stolen information.

How to start: Bluetooth > Scanning > Skimmer Detection

What you see: A list of suspected skimmer devices, each showing:

  • Device name (typically generic module names like “HC-05” or “HC-06”)
  • MAC address
  • Signal strength (RSSI)

Tips:

  • If you detect a suspected skimmer, do not attempt to remove it yourself. Report it to the establishment’s management and contact local authorities.
  • Common locations for skimmers include gas station pumps, standalone ATMs, and self-checkout kiosks.
  • Not all HC-05/HC-06 modules are skimmers – they are also used in legitimate hobbyist and IoT projects. The context of where you find them matters.

Axon Body Camera Detection

Detects Axon (formerly TASER) body-worn cameras used by law enforcement. These cameras broadcast identifiable BLE signatures that this scanner picks up.

How to start: Bluetooth > Scanning > Axon Camera

What you see: A list of detected cameras, each showing:

  • Device name
  • MAC address
  • Signal strength (RSSI)

Tips:

  • Axon body cameras are primarily used by law enforcement and security personnel.
  • Detection can help you identify the presence of body-worn recording devices in your vicinity.

Requires firmware v1.0.94 or later.

Meshtastic Detection

Detects Meshtastic long-range mesh radio devices. Meshtastic is a popular open-source project that uses LoRa radios to create off-grid mesh communication networks. This scanner identifies Meshtastic nodes broadcasting via BLE.

How to start: Bluetooth > Scanning > Meshtastic

What you see: A list of detected Meshtastic nodes, each showing:

  • Device name
  • MAC address
  • Signal strength (RSSI)

Tips:

  • Meshtastic nodes use BLE for local configuration and communication with a companion app, and LoRa for long-range mesh networking.
  • Detection of Meshtastic nodes can reveal the presence of an off-grid communication network in the area.

Requires firmware v1.0.94 or later.

Drone Detection (Remote ID)

Detects drones broadcasting FAA Remote ID signals. Since 2024, most drones sold in the United States are required to broadcast identification and location data. Biscuit captures these broadcasts over both WiFi and BLE.

How to start: Bluetooth > Scanning > Drone Detection

What you see: A list of detected drones with detailed information for each:

  • Drone identification – Unique ID or serial number of the drone
  • Type – The aircraft category: multirotor, airplane, helicopter, VTOL (vertical takeoff and landing), or glider
  • Status – Whether the drone is on the ground or airborne
  • GPS position – Latitude and longitude of the drone’s current location
  • Altitude – Height above ground level
  • Speed – Current flight speed
  • Heading – Direction of travel
  • Operator location – GPS coordinates of the drone operator (when broadcast by the drone)
  • Signal strength (RSSI)

Tips:

  • This is useful for identifying drones operating in your vicinity and understanding their flight patterns.
  • The operator location field reveals where the person controlling the drone is standing, which is valuable for security assessments.
  • Not all drones broadcast Remote ID. Older drones, custom-built drones, and some hobby drones may not transmit these signals.
  • Remote ID is broadcast over both WiFi beacon frames and BLE advertisements. Biscuit monitors both channels.

Requires firmware v1.2.0 or later.

General Tips

  • Signal strength is color-coded across all scan modes: green for strong, yellow for fair, red for weak.
  • Foxhunt integration: From any Bluetooth scan, tap the Foxhunt icon on a device card to switch into Foxhunt mode and physically locate that device by tracking its signal strength.
  • Wardriving integration: To map Bluetooth devices to GPS locations, use the Wardriving feature with a Bluetooth-enabled mode (Bluetooth Only, BT+Flock, or All).
  • Scan persistence: Scan results are cleared when you start a new scan of the same type. Switch between scan types without losing results from other modes.