HTTP-based command-and-control (C2) is malware communication that uses ordinary web requests and responses to exchange instructions, status, or stolen data. The malware may look like a browser, sending GET or POST requests to a remote server and receiving tasking in response.
This matters because HTTP is widely allowed through firewalls and is common on corporate networks, so malicious traffic can blend in with normal browsing and API calls. Defenders often look for signs such as unusual user agents, repetitive beaconing intervals, strange URLs, encoded parameters, or traffic to rare domains and IPs. Some malware uses HTTPS to make inspection harder, while others switch to DNS or other transports when web proxy monitoring is strong. Detecting HTTP-based C2 usually relies on proxy logs, endpoint telemetry, and behavioral patterns rather than content alone.