Possible JSCeal MITM proxy interception of Binance/Bybit TLS session
Detects anomalous TLS traffic directed at Binance or Bybit domains where the server certificate issuer is not from a known trusted certificate authority. This behavior is indicative of a Man-in-the-Middle (MITM) proxy interception, often associated with tools like JSCeal attempting to inspect or modify encrypted traffic to financial services.
Suricata
