Interesting, wondering why Apple doesn't restrict the queries to its server using a certificate that would be pinned on the devices, etc, so at least you would need a legit iPhone/Mac to be able to do a query?