Bluekit PhaaS Operator Domain DNS Lookup from Phishing Lure Click
Detects DNS resolution of known Bluekit PhaaS (Phishing-as-a-Service) operator domains. These domains are associated with phishing lures that leverage LLMs for localized content and voice cloning, and this detection identifies when a host attempts to resolve these specific malicious domains, indicating a likely interaction with a phishing lure.
YARA-L
