C2Looper C2 beacon check-in via /api/beacon

Emiliano Mema@Nosalva

•updated Aug 19, 2026•0•0•4

Detects outbound HTTP POST requests to a URI path '/api/beacon' containing a specific JSON structure ('id', 'user', 'host', 'pid'), which is characteristic of the C2Looper beaconing behavior.