TAG-182 typosquatted C2 domain query (Microsoft/Google/Facebook/VPN brand impersonation)

Duo Tech@duotech

•updated Jul 7, 2026•0•0•4

Detects DNS queries for known typosquatted domains associated with Command and Control (C2) activity. The rule monitors for queries targeting lookalike domains impersonating well-known brands such as Microsoft, Google, Facebook, and various VPN services.