Fuzzy Matching to Find Phishy Domains
ID: aa8b92ca-afcb-545b-8ea4-1ba60ad31bad
STIX ID: report--aa8b92ca-afcb-545b-8ea4-1ba60ad31bad
Feed Name: Censys Blog
Date Published: 2024-01-26
Date Updated: 2026-04-27
Author: Ivonne Francia; Ariana Mirian; Senior Security Researcher
...
...
This Censys write-up explains a practical method to proactively find and triage domain and brand impersonators by fuzzy-matching Censys DNS data in BigQuery using a Levenshtein Distance UDF. It details comparing tokenized URLs (excluding TLDs), setting similarity thresholds, and enriching matches with ASN and certificate issuer metadata to help organizations quickly identify and block suspicious domains.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.