DNS query to lookalike C2 domain coder-infra.com (Coder registry compromise)

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•3

This rule monitors for DNS queries, HTTP requests to '/cli/check', and TLS SNI traffic directed towards the domain 'coder-infra.com', which is associated with a suspected compromise of a Coder registry.