Evasive VPN traffic circumvents network restrictions and firewall rules by using techniques such as traffic masking or protocol obfuscation, making VPN traffic appear similar to regular web traffic.

This widget displays the total number of evasive VPN connections, along with the process or application name identified by the Encrypted Visibility Engine (EVE) for each connection. To view detailed connection events for a specific EVE process or application, click the EVE Process Name or Application name at the bottom of the widget. This action opens the Connection Events window, where all connections associated with the selected EVE Process Name or Application name and classified as Evasive VPN traffic are filtered and displayed.

Recommended action: To block evasive VPN traffic, create or update an access control rule to block traffic to the identified EVE processes or application.

Encrypted DNS traffic refers to DNS queries that are secured using advanced encryption protocols, making it difficult for traditional DNS filtering systems and firewalls to inspect or block them.

This widget displays the total number of encrypted DNS connections and highlights the top responder IP addresses, identified from known resolver lists. To view detailed connection events for a specific responder IP address, click the Responder IP address at the bottom of the widget. This action opens the Connection Events window, where all connections associated with the selected Responder IP address and classified as Encrypted DNS traffic are filtered and displayed.

Recommended action: To block encrypted DNS traffic, create or update an access control rule to block traffic to the identified responder IP addresses.

Domain fronting conceals the actual destination of encrypted traffic by advertising a widely trusted front domain during the TLS handshake (using the SNI field), while the HTTP Host header inside the encrypted session specifies a different backend service hosted by the same provider. This technique can bypass basic domain-based filtering and requires advanced traffic inspection for reliable detection.

This widget displays the total number of connections and highlights the top server names that are identified as domain fronting URLs. To view detailed connection events for a specific server, click the Server Name at the bottom of the widget. This action opens the Connection Events window, where all connections associated with the selected server name and classified as Domain Fronting traffic are filtered and displayed.

Note	Domain fronting is detected only when decryption is enabled.

Recommended action: To block domain fronting traffic, create or update an access control rule to block traffic to the identified server URLs. You can also block domain fronting traffic by creating a custom detector to match a set of related server URLs, and then add a rule to block the custom application.

Multihop proxies route internet traffic through multiple intermediary servers before reaching the final destination, adding additional layers of obfuscation and privacy.

This widget displays the total number of multihop proxy connections and highlights the top responder IP addresses, identified from known resolver lists. To view detailed connection events for a specific responder IP address, click the Responder IP address at the bottom of the widget. This action opens the Connection Events window, where all connections associated with the selected Responder IP address and classified as Multihop Proxy traffic are filtered and displayed.

Recommended action: To block multihop proxy traffic, create or update an access control rule to block traffic to the identified responder IP addresses.

FakeTLS attempts to evade basic domain-based filtering by presenting a trusted domain name during a TLS/HTTPS session, while actually connecting to infrastructure not legitimately associated with that domain. Also, parts of the TLS handshake, such as cipher suite lists and extensions, can be faked or modified to appear legitimate, and may include unusual or unregistered cipher suites.

This widget displays the total number of fake TLS traffic connections and highlights the top responder IP addresses, identified from known resolver lists. To view detailed connection events for a specific responder IP address, click the Responder IP address at the bottom of the widget. This action opens the Connection Events window, where all connections associated with the selected Responder IP address and classified as Fake TLS traffic are filtered and displayed.

Note	Fake TLS traffic is detected only when EVE is enabled.

Recommended action: To block fake TLS traffic, create or update an access control rule to block traffic to the identified responder IP addresses.