C2 heartbeat beacon TLS SNI tt.yeyoujs.com on tunnel port 9443

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•2

Detects periodic heartbeat beaconing activity to the domain 'tt.yeyoujs.com' over both encrypted TLS (SNI observation on port 9443) and DNS queries. This pattern is indicative of a command-and-control (C2) channel establishing or maintaining persistence.