HTTP Request to Blogspot-Hosted C2/Staging Infrastructure (Veil#Drop)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

This rule detects outbound HTTP requests to the blogspot.com domain, which is often used by malware for command-and-control (C2) communication, staging, or as an initial check-in mechanism. Attackers frequently abuse legitimate blogging platforms to host malicious content and evade network-based detections that might otherwise flag unknown or suspicious domains.