Multi-hop HTTP redirect chain across OnyxC2 phishing lure domains

Duo Tech@duotech

•updated Aug 14, 2026•0•0•2

Detects a multi-hop HTTP redirect chain traversing two or more known OnyxC2 phishing lure domains from the same host within a two-minute window, consistent with the redirect obfuscation used before final payload delivery.