The Gentlemen Ransomware C2 Tunnel DNS Lookup to trycloudflare.com

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects DNS queries for domains ending in '.trycloudflare.com', which are commonly used to establish unauthorized remote access tunnels (Cloudflare Tunnel) by threat actors for C2 communication.