Bluekit PhaaS BitM rrweb DOM Streaming via WebSocket on Login Pages

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•3

This rule monitors DNS query logs for attempts to resolve domains associated with 'rrweb' or 'rrweb-snapshot'. These libraries are legitimate tools for session recording and DOM snapshotting but have been increasingly observed in malicious activity, specifically in web-based credential theft, automated session hijacking, or exfiltration of sensitive user activity via session recording.