Phantom Squatting - Postal/Courier Brand LLM-Hallucination Pattern DNS Query

Duo Tech@duotech

•updated Jul 1, 2026•0•0•5

This rule detects DNS queries for domain names that exhibit patterns indicative of 'phantom squatting' targeting postal and courier services. These patterns often involve concatenating brand-related keywords (e.g., 'post', 'parcel', 'delivery') with service-oriented suffixes (e.g., '-login', '-verify', '-app') to create lookalike domains intended for phishing, credential harvesting, or infrastructure staging.