@hyc yeah. Perhaps most realistically, a Tor user (which normally uses SOCKS5) going to a HTTPS site that has been breached or similar