DNS/HTTP lookup to known passkey/SSO phishing domain infrastructure

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•0

Detects DNS resolutions, TLS SNI, and HTTP host requests to known malicious phishing domains impersonating passkey and SSO infrastructure, often associated with Storm-3121/Storm-3032 activities.