Newly Registered Typosquatting Domain Detection

📌 Description Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors. 🔍 Threat Intelligence Feed The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains. API Endpoint: https://isc.sans.edu/api/recentdomains/today?json Use Cases: Threat intelligence enrichment Detection of suspicious or malicious domains Security log correlation Returned Data Fields: Domain name Registration date IP address Type Additional metadata (if available) Query by Date (Optional): Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json 🎯 ATT&CK Framework Mapping Technique: Acquire Infrastructure: Domains ID: T1583.001 Reference: MITRE ATT&CK