JDY Botnet Tor-Based C2: Outbound Connections to Tor Ports or .onion DNS Queries

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule identifies potential use of the Tor network by detecting network connections to common Tor relay ports (9001, 9030, 9050, 9051, 9150) that are external to internal subnets, or by identifying DNS requests for .onion domains.