DNS/TLS lookup to passkey-themed typosquat phishing domains

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•1

This rule monitors DNS queries and TLS SNI traffic for connections to domains that appear to be performing typosquatting, specifically targeting users by impersonating SSO and Passkey service providers. These domains mimic legitimate security portals to facilitate credential harvesting.