Hijacked Legitimate Domain Used for C2

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects HTTP traffic where the host header contains a domain with at least 8 alphanumeric characters followed by a common top-level domain (.com, .net, .org), and the URI contains the string 'gate' (case-insensitive). This pattern is indicative of a hijacked legitimate domain being used for Command and Control (C2) communication.