Sandboxing does including limiting network connections until you approve them, this kind of traffic would have been easy to detect