Payroll Pirate: bluegraintours.com AiTM Phishing URL in Email or DNS

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule monitors DNS query events to detect internal systems attempting to resolve the domain 'bluegraintours.com', which is indicative of potential command and control (C2) communication or malware activity.