Fraudulent E-commerce Operators
This attacker group engages in fraudulent activity by registering lookalike domains through Namecheap, often mimicking well-known brands by appending terms like LLC, LTD, Inc, or Corp. Their tactics involve sending fraudulent quote requests via Namecheap's private email service, followed by attempts to purchase goods on credit. These goods are routed through freight forwarders, typically bound for Western Africa. With increasing scrutiny on cash transactions to high-risk regions, they have shifted focus to acquiring goods. It is crucial to thoroughly validate any flagged messages and verify credit information before releasing products to these entities.
Sublime rule (View on GitHub)
1name: "Fraudulent E-commerce Operators"
2description: "This attacker group engages in fraudulent activity by registering lookalike domains through Namecheap, often mimicking well-known brands by appending terms like LLC, LTD, Inc, or Corp. Their tactics involve sending fraudulent quote requests via Namecheap's private email service, followed by attempts to purchase goods on credit. These goods are routed through freight forwarders, typically bound for Western Africa. With increasing scrutiny on cash transactions to high-risk regions, they have shifted focus to acquiring goods. It is crucial to thoroughly validate any flagged messages and verify credit information before releasing products to these entities."
3type: "rule"
4severity: "high"
5source: |
6 type.inbound
7 and strings.starts_with(headers.mailer, 'Open-Xchange Mailer')
8 and strings.ends_with(headers.message_id, '@privateemail.com>')
9 and regex.imatch(sender.email.domain.sld, '.*(?:llc|ltd|inc|corp|llp|co)')
10
11attack_types:
12 - "BEC/Fraud"
13tactics_and_techniques:
14 - "Impersonation: Brand"
15 - "Lookalike domain"
16 - "Social engineering"
17detection_methods:
18 - "Content analysis"
19 - "Header analysis"
20 - "Sender analysis"
21id: "3776a6fc-73b6-59e3-89c9-317eba43755c"