Phantom Squatting - Two+ Brand-Impersonation Domains Queried Within 18 Minutes

Duo Tech@duotech

•updated Jul 1, 2026•2•0•12

This rule detects rapid sequential DNS queries by a single host for multiple domains that mirror common brand impersonation patterns (e.g., login, business, empresas, post-app). The detection logic flags when at least two unique domains matching these patterns are queried within an 18-minute window, which is indicative of potential credential harvesting or phishing reconnaissance.