Payroll Pirates - DNS query to Google Ads click-tracking infrastructure (chain start)

Duo Tech@duotech

•updated Aug 10, 2026•1•0•7

Detects DNS queries to Google Ads click-tracking infrastructure followed within 60 seconds by resolution of a newly registered, previously unseen domain, consistent with the Storm-2755 AiTM redirect chain.