DNS/TLS lookup to known passkey/SSO-themed phishing domains

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•1

This rule detects DNS queries and TLS SNI traffic directed towards identified phishing or malicious domains that mimic Passkey, Single Sign-On (SSO), or help desk authentication portals. These domains are commonly used by attackers for credential harvesting or adversary-in-the-middle (AiTM) phishing attacks targeting organizational authentication services.