Bluekit PhaaS LLM-Lure Infrastructure Network Connection Detection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•3

This rule detects network connections or DNS queries originating from an endpoint towards domains or IP addresses associated with BlueKit command-and-control (C2) infrastructure, including TLDs (pk, ws, cc, su) and onion-based addresses. This activity is indicative of potential malware communication or C2 beacons.