Encrypted, but the server name is not
The payload is TLS, but every Client Hello names its server in the SNI field. List them with tshark, spot the lookalike name, and catch a client that claims a famous name without looking it up.
Briefing
A short capture from the office uplink is all you have; the traffic is HTTPS, so there are no URLs to read.
The Server Name Indication in a TLS Client Hello is sent in the clear (unless Encrypted Client Hello is used). Matching it against the DNS answers in the same capture shows whether a client looked the name up at all.
sensor-01 · Packet captures
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.