diff --git a/rules/detection-rules.json b/rules/detection-rules.json
index ad01d82..cf10c7e 100644
--- a/rules/detection-rules.json
+++ b/rules/detection-rules.json
@@ -60,7 +60,10 @@
       "^https:\\/\\/(?:[^/]*\\.)?zoom\\.us(/.*)?$",
       "^https:\\/\\/github\\.com(/.*)?$",
       "^https:\\/\\/[^/]*\\.github\\.com(/.*)?$",
-      "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$"
+      "^https:\\/\\/[^/]*\\.github\\.io(/.*)?$",
+      "^https:\\/\\/[^/]*\\.amazonaws\\.com(/.*)?$",
+      "^https:\\/\\/[^/]*\\.fox\\.com(/.*)?$",
+      "^https:\\/\\/(?:[^/]*\\.)?googleadservices\\.com(/.*)?$"
     ],
     "context_indicators": {
       "description": "Additional context that indicates legitimate discussion vs phishing",
@@ -2011,7 +2014,7 @@
   "domain_squatting": {
     "description": "Domain squatting detection configuration to protect against typosquatting, homoglyphs, and combosquatting attacks",
     "action": "block",
-    "deviation_threshold": 2,
+    "deviation_threshold": 4,
     "algorithms": {
       "levenshtein": true,
       "homoglyph": true,