Outbound TLS connection to code.newcli.com proxy anonymizing Western AI tool traffic

Duo Tech@duotech

•updated Jul 30, 2026•1•0•35

Detects outbound TLS/HTTP traffic to the code.newcli.com proxy used to anonymize Western AI tool (Claude Code, Codex) traffic, matching exact SNI/Host plus the /codex/v1 or /ultra endpoint paths.