Bulk typosquat DNS queries impersonating brand strings on cheap TLDs

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

Detects DNS queries for domains containing specific brand-related strings (such as government agencies or courier services) coupled with high-risk top-level domains (TLDs). This pattern is frequently used by adversaries to register infrastructure for phishing and social engineering campaigns by mimicking legitimate organizational presence.