QTFY DNS query for known C2 infrastructure domain

Arnold Chan@slaz

•updated Sep 13, 2026•1•0•2

This rule detects network traffic (DNS, TLS, HTTP, and TCP) originating from internal assets to known infrastructure associated with the QTFY proxy botnet/C2 framework. It identifies communication with specific C2 domains, proxy management systems, and associated malicious IP ranges.