IronToll - TLS Cert Issuer CN 'YE1' Observed with Disposable-TLD SNI

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•2

This rule monitors TLS traffic for a specific combination of certificate issuer Common Name (CN) matching 'YE1' and Server Name Indication (SNI) hostnames using known disposable or high-risk top-level domains (TLDs). This behavior is associated with the IronToll campaign, often indicative of command-and-control communication or malicious infrastructure staging.