IronToll - Government/Brand Impersonation Keyword on Non-Standard TLD (Lookalike Domain)

Arnold Chan@slaz

•updated 28 days ago•0•0•3

Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.