LeakySensey: Possible Xray VLESS/REALITY TLS obfuscation - missing SNI indicative of DPI/TSPU evasion

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•2

Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.