Coordinated multi-domain phishing registration cluster (same registrar/NS/privacy, 18-min window)

Duo Tech@duotech

•updated Jul 9, 2026•0•0•3

This rule detects potential bulk domain registration activity by grouping registrations by registrar, name server, and a 18-minute window. It specifically flags cases where multiple domains are registered with privacy protection enabled, which is a common tactic for adversaries setting up large-scale C2 or phishing infrastructure.