You know there's nothing dodgy running in addition to the software. When there's a public instance, the connection could be terminated by (say) an Nginx reverse proxy that sends your traffic to a log.