@Rairii also, I’ve had perhaps a dozen people over the years see the web socket connection and interpret it as a command and control channel for ransomware