At DNS Spy we're proud to give back to the open source community by helping important projects monitor their domains. This includes @The_Pi_Hole, @laravelio, @caddyserver, @IrssiProject & many more 👍 dnsspy.io/supporting-open-so…

📡 New in DNS Spy: Syslog Alerts Every DNS alert as RFC 5424 over TLS — with CEF or JSON payloads, severity-mapped priorities, and one static egress IP to allowlist. QRadar, ArcSight, LogRhythm, rsyslog: no middleware needed. dnsspy.io/blog/dns-alerts-ov…

🚨 New: GoDaddy support in DNS Spy Connect a read-only API token (just 2 scopes), import every domain in your account, and we'll monitor all your DNS records automatically — verifying what your nameservers *actually* answer, not just what the API claims. dnsspy.io/dns-providers/goda…

🚨 New: Amazon Route 53 support in DNS Spy Connect a read-only IAM key (just 2 permissions), import every hosted zone, and we'll monitor all your records automatically — verifying what your nameservers *actually* answer, not just what the API claims. dnsspy.io/dns-providers/rout…

Bunny just made their DNS free. No query fees, no limits, free for up to 500 domains. Good deal. But free DNS still won't tell you when a record changes, a domain expires, or a cert lapses. Our honest review + how to monitor it: dnsspy.io/blog/bunny-dns-fre… #dns #cybersecurity

See your domain attack surface the way attackers do. Monitor for lookalike & impersonation domains before they're weaponized 👇 dnsspy.io

That's the window defenders can win. Lookalike domains get registered and staged early. Watch the domain layer and an impersonation domain shows up at registration — not in a victim's help-desk ticket.

Why it works isn't technical. It's trust. Microsoft is one of the most impersonated brands in phishing. A "Microsoft" warning carries borrowed authority — and that authority is staged on lookalike, MS-adjacent domains registered before the emails go out.

NarwhalRAT runs in memory, uses multiple C2 channels (incl. the pCloud API + hacked Korean sites), and can log keys, grab screenshots, and record audio. Notable: APT37 historically used only RokRAT. New tooling = active investment.

The lure: an email posing as a Microsoft alert about account compromise + OTP abuse. It tells you to open an attached "advisory." It's not a doc — it's a ZIP with a malicious .lnk shortcut that kicks off a multi-stage loader → NarwhalRAT.

🚨New free tool: scan your domain for the lookalikes impersonating your brand. Typosquats, homoglyphs, TLD swaps, combosquatting — we generate them all, then live-check DNS + WHOIS to show which are actually weaponized. No signup. Results in seconds 👇 dnsspy.io/typosquatting-scan…

We were seeing lots of DNSSEC failures across many TLDs about 40 minutes ago. As a result, we marked some domains as offline. We are still investigating the root cause.

Anyone who is using a SHA-1 DNSSEC key algoritm should be upgrading immediately! dns.cam.ac.uk/news/2020-01-0…