Possible DOUBLECUP DNS tunneling via high-entropy Microsoft telemetry lookalike domain

Duo Tech@duotech

•updated Aug 4, 2026•2•0•5

Detects DNS tunneling via high-entropy subdomains prepended to Microsoft-telemetry-lookalike domains, using a volume threshold to distinguish tunneling from occasional lookups.