Lookalike .shop Domains Matching Monitored Brand Keywords

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•1

This rule monitors DNS and email traffic for domains ending in .shop that fuzzy-match against a predefined watchlist of corporate brand names. This behavior is commonly associated with phishing campaigns, brand impersonation, or typosquatting, where attackers use similar-looking domains to lure users into revealing sensitive information or credentials.