LokiBot C2 HTTP beacon to fre.php endpoints (kelly/five and alien paths)

Duo Tech@duotech

•updated Jun 30, 2026•1•0•1

Detects HTTP traffic patterns associated with LokiBot malware beaconing to a hardcoded command and control (C2) endpoint. The rule specifically looks for established network connections to identified malicious domains or IP addresses using the /fre.php URI path.