OK... so I wasn't going to mess about with running a web browser in the background!
This was a bit of a pig to reverse engineer as I am also not a developer.
The server-side web page is useless as the values are not in the initial HTML. It's written into the DOM after the page loads using a binary WebSocket frame. It's populated from a WebSocket callback that parses a binary payload.
Running 'curl --compressed -s http://<IP>/start.html -o start.html' gives you what you need...
I eventually realised that there seems to be a difference between client-side logic that uses internal state and actual network telemetry.
The bottom line is that these devices are using canvas-only rendering from a non-numeric state.
That's ****** manufacturer behaviour to specifically prevent 3rd party integration!
OCR from the webpage is the only viable solution using the likes of selenium/playwright and headless chromium.
I bought this in a sale as redundancy for my home made salinity monitor - it was a painful journey!
Mine is more accurate, uses a better probe and is cheaper whilst fully integrating in to HA though ESPHome
https://community.home-assistant.io...nsor-with-integrated-temperature-probe/930263
**EDIT**
FWIW, no good commercial options exist because using EC to determine salinity is fundamentally flawed IMO! I'm still happy with my probe and it was months and months of work getting the code correct. Mine is far faster to respond that the Reef Keeper which makes me think they are applying excessive filtering to smooth out the noise! Buyer beware!