JadeProx known C2/phishing domain observed in TLS SNI

Duo Tech@duotech

•updated Jul 27, 2026•1•0•4

This rule monitors outbound TLS traffic for Server Name Indication (SNI) fields matching known C2 or phishing domains associated with the JadeProx activity. This indicates a potential connection from an internal host to malicious infrastructure.