Outbound TLS connection to ngrok.io tunneling infrastructure

Emiliano Mema@Nosalva

•updated Jul 16, 2026•1•0•8

Detects outbound TLS traffic directed toward ngrok.io infrastructure originating from Azure Container Instances. Ngrok is frequently used by adversaries to establish reverse proxies and tunnels to maintain persistent command-and-control access to compromised cloud-hosted containers.