DoppelBrand campaign - DNS query for known IOC domain (service-nowinc.com/domainlify.net)

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•4

Detects network activity and email headers associated with the DoppelBrand campaign. The rule monitors DNS queries for specific IOC domains (service-nowinc.com, domainlify.net) and inspects SMTP traffic for malicious MAIL FROM addresses and Reply-To headers targeting these domains.