The remains of Belkin's smart-home system reveal how difficult it is to dismantle a connected product after the company leaves.
A Wemo smart plug can still be sitting in a wall, its white plastic intact. Press its button and it may still click. Nothing about the object necessarily looks dead.
What disappeared was the arrangement around it.
On 31 January 2026, Belkin shut down Wemo's cloud service and app support. Remote access ended. Alexa and Google Assistant integrations stopped working. The app could no longer perform the work that had made a plug, switch, heater or coffee maker “smart.”
Follow the remains from the wall into the phone, and then out to the internet, and different parts of the same product appear alive, dead or somewhere in between.
The first split
Belkin's table lists 27 affected models with three outcomes. Nineteen lost Wemo smart controls. Eight could continue through Apple Home only if configured before shutdown. Four Thread products were unaffected.
That makes prior configuration as important as the hardware itself. Two similar switches could reach 1 February with different futures because one had been introduced to Apple's system before the deadline and the other had not. After the cutoff, Belkin said, owners could no longer set up or reconfigure a Wemo device through the Wemo app or HomeKit.
The refund offer also split owners. Belkin required proof of purchase and a valid warranty. Its dates suggest that only the WSP090 outdoor plug and WSP080 mini plug could have remained within their maximum listed windows. Actual eligibility depended on purchase date.
For Joe Fettig, according to a proposed class-action complaint, that distinction ran through much of his home. The Indiana resident said he bought about 18 Wemo products for roughly $595 because they worked through an app and voice assistants. He contacted Belkin after the shutdown announcement but, he alleged, received no refund.
Cal Krome described a smaller system with the same problem: about three light switches and five smart plugs. By the time the complaint was filed, the California resident alleged that he had spent about $200 replacing Wemo products.
These are allegations, not findings by a court. But they turn a product table into rooms, routines and replacement bills. The device was not simply the thing in the wall. It was also the protocol it spoke, the platform it had already joined and the date on which its owner completed setup.
The app outlived the service
A phone does not know that a product has reached the end of its life. Unless an owner removes it, the app can remain where it was, still holding the instructions and permissions it accumulated while the service was alive.
The last inspected Android release, Wemo 1.30.2, arrived three months before shutdown. A static examination found 24 requested permissions, covering functions such as Wi-Fi, Bluetooth, location and camera access for setup, notifications, legacy storage and biometric login.
Those permissions are not evidence of data collection or abuse. A manifest describes what an app was built to request. Ending a cloud service does not remove installed software or erase its trust relationships.
The app also carried an address book for the system it once served. These are the relevant lines, placed together from its production configuration:
var cloudEnvironment = {
PRODUCTION: "https://api.xwemo.com:8443",
USERACCOUNT_PRODUCTION: "https://appapis.xwemo.com:8443"
};
var firmwareCloudEnvironment = {
PRODUCTION: "https://fw.xbcs.net"
};
const CLOUD_HEALTH_APIS = {
production: 'https://wemocloudhealth.xwemo.com/cloud-availability/cloud.json'
};To the app, these were destinations: cloud, accounts, firmware and a check on whether the cloud was healthy. Older, staging and test addresses also remained. Some were comments or mock data. Their presence cannot prove the final app contacted them.
On 30 September, DNS checks for the main cloud, account service, cloud-health host and firmware host returned NXDOMAIN. The internet's directory now says those addresses do not exist.
Even here, the system did not vanish evenly. The parent xwemo.com registration remained active. Two Wemo-linked hosts under another domain, heartbeat.lswf.net and wemoci.lswf.net, still resolved. The production doors had closed, but pieces of the estate remained standing.
An address in limbo
The least recognisable name was not new. Researchers reported that many Wemo plugs communicated with api.xbcs.net. A later study documented a move to deviceapis.xwemo.com, while a test switch still contacted the old API intermittently.
The final app selected fw.xbcs.net as its production firmware base. That does not show every model called the domain after shutdown. It shows the domain family had served more than one layer of Wemo.
Then the parent domain began its own exit.
The registry record shows that xbcs.net expired on 17 August 2026. On 28 September, its status changed to “redemption period.” That phrase does not mean an attacker owns the domain. Under ICANN's domain lifecycle, it means deletion has been requested and the name has been removed from DNS, while the previous registrant still has a limited period in which to restore it.
Nothing dramatic needs to happen for the scene to become strange. Hardware remains in homes. The app can remain on phones. Its address book points partly nowhere. A domain once used by the system moves through an ordinary deletion process. Each fact belongs to a different custodian.
Fettig and Krome asked a court to place responsibility with Belkin, alleging that the shutdown deprived buyers of the premium value of smart products. Belkin answered after the case moved to the Central District of California. The reviewed public docket contains no merits decision.
The missing custodian
The rules divide the same way. Consumer law looks at warranties and promises. Cybersecurity rules look at manufacturers and support periods. Control of an expired address moves to registrants, registrars and ICANN.
The Federal Trade Commission says omitted software-support information may violate warranty or consumer-protection law depending on the facts. The voluntary US Cyber Trust Mark asks participants to disclose support periods.
Britain requires publication of minimum security-update periods, although the government said in February that it planned no minimum period for smart-home technology. Australia's rules cover support dates for devices made from March 2026. The EU Cyber Resilience Act will require vulnerability handling during a declared support period, but most provisions apply from December 2027.
These are real obligations, not an absence of law. But the reviewed regimes did not reveal a clear rule requiring a manufacturer to retain, monitor, sinkhole or otherwise steward every old domain after shutting down a product cloud.
The result is a handoff without a single receiving party. Consumer agencies can ask what buyers were promised. Security regulators can ask how long patches will arrive. ICANN governs registration and deletion, not product safety. App platforms govern distribution, but they do not own the switch in the wall. Each institution can see one piece of the Wemo system. None is plainly charged with proving that the whole arrangement has been safely dismantled.
Between Wemo's 2012 launch, Foxconn's 2018 acquisition of Belkin and the shutdown, a household object became a temporary agreement among hardware, software, accounts, servers, certificates, domains and outside platforms.
The plug is still the easiest part to see. It can remain in the wall long after that agreement has begun to come apart. What Wemo leaves unresolved is not whether the object is alive or dead. It is who must account for all the pieces once no one is keeping the arrangement alive.
