2 ms·

the middlebox could just pass traffic for the unknown TLDs tho and that detectin method would be in vain