IronToll PhaaS - Connection to Known C2 IP (Tencent/Alibaba Cloud)

Arnold Chan@slaz

•updated 28 days ago•0•0•5

Detects TCP connections on standard web ports from internal hosts to known IronToll C2 IPs on Tencent/Alibaba Cloud. Scoped to web ports and an established handshake, with a per-source hourly alert cap to reduce repeat noise.