Threatmatic · π inspector

What does π actually catch?

Most network tools watch how much traffic moves, and where it goes. π decrypts and reads what's actually inside — which means it catches the things that look completely ordinary from the outside. Nine real examples, each shown as an actual exhibit: the traffic, the tell, what it means.

named detections

visible at the network layer alone

inspector, reading the payload

DNS hiding inside an ordinary HTTPS request

decrypted request — port 443

POST /dns-query HTTP/2
Host: dns.google
Content-Type: application/dns-message
Content-Length: 44

Ordinary DNS is UDP on port 53, plaintext — every network tool sees the question being asked. DoH wraps the same query inside a normal-looking HTTPS POST. At the network layer, this is indistinguishable from any other web request. The only place the tell exists is inside the payload itself.

blocks: DNS-over-HTTPS tunneling

A pasted secret, to a domain that looks completely fine

decrypted request body — legitimate SaaS domain

{"model":"gpt-x","messages":[{"role":"user","content":"here's our churn model source + the Q3 customer list, can you refactor it..."}]}

A URL/domain filter has nothing to flag here — the destination is a legitimate, popular AI product. The problem was never where the request went. It's what an employee pasted into it.

blocks: unsanctioned AI tools handling sensitive data

A very large upload to a personal account

decrypted request headers

PUT /upload/share/9f2a HTTP/2
Host: personal-cloud-storage.example
Content-Length: 340104857
X-Account-Type: free-personal

340MB leaving on a free personal-tier account, mid-afternoon, from a device that has no business reason to be moving files that size to that destination. Nothing about the connection itself is abnormal — TLS handshake, cert, port, all clean. The size and the account type are the whole story.

blocks: unsanctioned cloud storage exfiltration

A remote-access tool, riding on the wrong port

decrypted handshake fingerprint

dest_port: 443
protocol_banner: "AnyDesk/7.1 relay-negotiate"
expected_for_port: TLS/HTTPS

Plenty of legitimate remote-support tools exist — the point isn't that this protocol ran, it's that it ran disguised as ordinary HTTPS, on the port everything else uses precisely so it won't stand out in a connection log.

blocks: unauthorized remote-access software

A resignation letter, over webmail

decrypted MIME headers

Content-Disposition: attachment; filename="client_contracts.zip"
To: <personal-account@webmail.example>
From: <employee@company.example>

The company's own mail system never sees this — it left through a browser tab, over ordinary HTTPS, to the employee's own personal inbox. Corporate DLP on the real mail server catches none of it, because it never touched the real mail server.

blocks: exfiltration through personal webmail

The hostname says one thing, the request says another

TLS handshake vs. decrypted Host header

TLS SNI: cdn.trusted-platform.example
decrypted Host: c2-relay-19.example
cert subject: CN=cdn.trusted-platform.example

Domain fronting: the outer, unencrypted handshake advertises a trusted CDN hostname so anything watching only the handshake — most network tools — waves it through. The decrypted request inside says where the traffic is actually going. The mismatch itself is the finding.

blocks: domain fronting / SNI-Host mismatch

A browser that isn't one

decrypted request headers

GET /api/v2/export?format=csv&all=true HTTP/1.1
User-Agent: python-requests/2.31.0
Accept: */*

A default, un-spoofed scripting-library User-Agent, hitting a bulk-export endpoint no human clicking around a browser would ever reach that way. Not inherently malicious — but it's a script talking, not a person, and that's worth knowing.

blocks: anomalous / scripted client traffic

A domain that isn't the one it looks like

decrypted SNI, decoded

raw SNI: xn--pple-43d.com
decoded: аpple.com (Cyrillic а, not Latin a)

A single substituted character, invisible at a glance in a browser address bar, encoded as punycode in the raw handshake. Reading the decoded form is the only way to see what a human would miss instantly.

blocks: homograph / punycode domain spoofing

A certificate minted five minutes ago

decrypted certificate chain

Issuer: CN=self-signed-ca
Not Before: 2026-05-08T09:14:02Z (11 minutes ago)
Subject: CN=login.company-portal.example

A certificate impersonating a real internal service, self-signed, issued minutes before it was used. Nothing about the connection's shape gives this away — only actually reading the certificate does.

blocks: suspicious / freshly-issued certificates

The tenth signal doesn't have a name.Every one of the nine above is a specific, recognized pattern — but plenty of bad traffic doesn't match a named signature at all. π also scores the raw entropy of every payload: a byte distribution that's statistically flat, riding on a protocol or a path that should carry plain text, gets flagged even when nothing about it matches a category by name.

That's the actual argument for reading the payload instead of just the metadata around it: named signatures catch what's already been seen before. Entropy catches the one that hasn't.

None of this required watching more traffic. It required actually reading the traffic that was already there.

Every example above is a real detection category π already evaluates against live traffic today — not a hypothetical.

← Back to The Wire