Jewelbug typosquatted C2 domain query (fonts.chrorne.com exact match)

Duo Tech@duotech

•updated Aug 14, 2026•0•0•3

Detects DNS queries and HTTP traffic to Jewelbug's known typosquatted C2 domains (fonts.chrorne[.]com, fonts.tarotfree101[.]top, robot.avbliud[.]com, www.f1ash[.]org[.]cn) via exact-match logic to avoid fuzzy-matching false positives.