Xray-core C2 traffic disguised with spoofed dl.google.com TLS SNI

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

Detects potential Command and Control (C2) beaconing activity associated with Xray-core, where the TLS Server Name Indication (SNI) field is spoofed to 'dl.google.com' to masquerade malicious traffic as legitimate Google-related traffic.