C2 Agent Enrollment HTTP POST to tt.yeyoujs.com (device/token registration)

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•4

Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.