You can see domains contacted by an iPhone app using Apple’s App Privacy Report in Settings. Start with the app’s network activity, then investigate individual domains in the context of what you were doing.
If you are asking “what servers does this app connect to?”, this is a useful starting point. A domain list identifies destinations recorded in the report; it is not a complete map of physical servers or a recording of everything sent to them.
Can you see what domains an iPhone app connects to?
Yes. App Privacy Report is an Apple iOS privacy feature that includes network-domain activity. It separates app-related connections from website-related activity, helping you distinguish an app’s communication from content viewed within it. For an overview of the other sections, read what App Privacy Report shows.
A domain is a name used to reach an internet service. One app can use many domains, and one domain can support many apps. A domain name does not necessarily identify one server, one owner or one purpose. Shared infrastructure and embedded services make those relationships more complicated.
How to inspect an app’s network activity on iPhone
- Open Settings > Privacy & Security > App Privacy Report.
- If the feature is off, turn it on and use your apps normally before returning to check it.
- Find App Network Activity and choose the app you want to investigate.
- Review the listed domains and open a domain’s available details. Note the app, domain and relevant timing rather than relying on the name alone.
- Check Website Network Activity if the connection could have come from an article, video or other website opened inside an app.
Begin with a specific question: which destinations appeared when you opened a feature, or whether an unfamiliar destination is associated with more than one app. A small, focused review is easier to interpret than trying to judge every domain on your phone at once.
Why is an app contacting many different domains?
An app may use separate services for sign-in, content, images, video delivery, syncing, crash reporting, analytics and advertising. Loading one screen can involve several destinations, especially when that screen contains web content. A long list therefore needs interpretation rather than an automatic warning.
For a fictional reading app, api.example.com might supply articles, media.example.net might deliver images, and metrics.example.org might receive measurements. These reserved example domains are illustrations only. Their names do not demonstrate what a real connection does.
Compare patterns with actions you remember. Did the list grow after playing a video or opening a help page? Is a domain present only during sign-in? These observations can suggest a reason to investigate, but they cannot establish the contents of the communication.
How do you investigate an unfamiliar domain?
Copy the exact domain, including any subdomain. Look for an explanation in the app’s privacy policy, support documentation or the service operator’s own documentation. If ownership information is available, treat it as context: the organization operating infrastructure may differ from the company using that infrastructure.
Keep a short note with the app, time, domain and feature you were using. If you later ask the developer about the event, those specifics are more useful than saying the app contacted “something suspicious.” Avoid opening every unfamiliar address simply to see what happens; a service endpoint may not have a useful public web page.
If you already have a particular destination in mind, follow how to find which iPhone app contacted a domain. That guide starts with a domain and works back to the associated apps.
Does a domain connection mean an app is tracking you?
No. A recorded connection alone does not prove tracking, harm or the transmission of personal information. A destination associated with known tracking or analytics services can be relevant evidence, but you still need context about the app, the service and how it is used.
Likewise, a familiar domain does not guarantee that every use is privacy-friendly. Classifications can help prioritize review; they do not replace an explanation of what data the app collects. Compare the report with the app’s privacy disclosures and your own preferences before deciding whether to change permissions or stop using it.
Is App Privacy Report a packet capture?
No. A domain activity record is different from capturing packets. It does not reveal HTTPS payloads, complete request bodies or every action the app performs. It cannot tell you conclusively whether your iPhone is compromised.
An absent entry also needs care: the activity may be outside the reporting period, collection may not have been enabled, or it may fall outside what the feature reports. Apple documents an exclusion for private browsing network activity in browser apps. Use the report as a bounded source of evidence.
How can you search and group a larger report?
Open App Privacy Report, use its Share button and save the exported .ndjson file in Files. The NDJSON guide explains how to open that export and handle it privately.
App Privacy Report Analyzer is a separate iPhone/iPad application for exploring exported App Privacy Report data. It can help you review activity by app, search domains and IP addresses where represented, group related domains, and examine timing. Domain classifications and ownership information, where available, provide leads for further investigation.
Analysis uses the records you import. The analyzer does not intercept live traffic or supply missing packet contents. If you want to review changes later, save report snapshots over time instead of assuming the built-in report is a permanent archive.
Explore the domains in your export
Search and group imported network activity on iPhone or iPad, then investigate the connections that matter to you.
Scan with iPhone