Mantax Otax v2 WebSocket C2 Upgrade Request to apimantax.otax.fun

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•2

This rule detects outgoing HTTP requests to 'apimantax.otax.fun' attempting to initiate a WebSocket upgrade connection. This is characteristic of the Mantax Otax v2 malware family establishing a Command and Control (C2) channel.