LeakySensey: Possible residential proxy relay - outbound HTTP CONNECT from consumer device

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•0

This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.