CLEANGULP AES-encrypted HTTP beacon registration to typosquat C2 domain

Arnold Chan@slaz

•updated Sep 23, 2026•0•0•3

Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.