JDY Botnet Tor C2: .onion DNS Queries and Tor Relay Port Connections from Edge Devices

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects anomalous network traffic patterns from SOHO/IoT and edge devices indicative of Tor-based C2 communication, including DNS queries for .onion domains, outbound connections to known Tor relay ports, and high-volume encrypted traffic over non-standard high-range ports.