Phantom/Typosquatted Package Registry Lookalike Domain DNS Query

Duo Tech@duotech

•updated Jul 1, 2026•0•0•2

Detects DNS queries for domains that are visually or phonetically similar to popular software package registry domains (such as PyPI or npm). These are often used in typosquatting campaigns to trick users or automated systems into downloading malicious packages.