Brand Impersonation: Shein

calendar Jul 27, 2026  ·
Share on: linkedin copy

Detects suspicious Shein-branded communications using display name impersonation, logo detection, and deceptive content analysis. Includes checks for security/authentication topics, secure messages, notifications, and promotional content like fake surveys or giveaways. Excludes legitimate Shein domains with proper authentication and known trusted senders.

Sublime rule (View on GitHub)

  1name: "Brand Impersonation: Shein"
  2description: "Detects suspicious Shein-branded communications using display name impersonation, logo detection, and deceptive content analysis. Includes checks for security/authentication topics, secure messages, notifications, and promotional content like fake surveys or giveaways. Excludes legitimate Shein domains with proper authentication and known trusted senders."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  and (
  8    // display name contains Shein
  9    (
 10      (
 11        regex.icontains(strings.replace_confusables(sender.display_name),
 12                        '\bsh[ie]{2}n\b'
 13        )
 14        and not strings.icontains(sender.display_name, "sheen")
 15      )
 16      or (
 17        length(ml.logo_detect(file.message_screenshot()).brands) == 1
 18        and all(ml.logo_detect(file.message_screenshot()).brands,
 19                .name == "Shein" and .confidence == "high"
 20        )
 21      )
 22    )
 23  )
 24  and (
 25    (
 26      length(ml.nlu_classifier(body.current_thread.text).topics) > 0
 27      and all(ml.nlu_classifier(body.current_thread.text).topics,
 28              .name in (
 29                "Security and Authentication",
 30                "Secure Message",
 31                "Reminders and Notifications",
 32                "Advertising and Promotions" // fake surveys/giveaways have been observed
 33              )
 34              and .confidence in ("medium", "high")
 35      )
 36    )
 37    or (
 38      beta.ocr(file.message_screenshot()).text != ""
 39      and length(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics
 40      ) > 0
 41      and all(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
 42              .name in (
 43                "Security and Authentication",
 44                "Secure Message",
 45                "Reminders and Notifications",
 46                "Advertising and Promotions" // fake surveys/giveaways have been observed
 47              )
 48              and .confidence in ("medium", "high")
 49      )
 50    )
 51    or any(ml.nlu_classifier(body.current_thread.text).intents,
 52           .name == "cred_theft" and .confidence == "high"
 53    )
 54    or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
 55           .name == "cred_theft" and .confidence == "high"
 56    )
 57  )
 58  
 59  // and the sender is not in org_domains or from Shein domains and passes auth
 60  and not (
 61    sender.email.domain.root_domain in $org_domains
 62    or (
 63      length(attachments) == 1
 64      // this is Shein's return label generator
 65      and all(attachments,
 66              .file_type == "pdf"
 67              and strings.icontains(beta.parse_exif(.).creator, "MondialRelay")
 68      )
 69    )
 70    or (
 71      sender.email.domain.root_domain in (
 72        "shein.com",
 73        "shein.com.mx",
 74        "sheinemail.com",
 75        "shein.co.uk",
 76        "sheingroup.com",
 77        "sheinnotice.com",
 78        "cash.app",
 79        "capitaloneshopping.com"
 80      )
 81      and (
 82        headers.auth_summary.dmarc.pass
 83        // for when DMARC fails, but it's still a legit Shein newsletter
 84        or (
 85          length(body.links) > 10
 86          and ratio(body.links,
 87                    .href_url.domain.root_domain in (
 88                      "shein.com",
 89                      "sheinemail.com",
 90                      "shein.co.uk",
 91                      "sheingroup.com",
 92                      "sheinnotice.com",
 93                      "cash.app",
 94                      "capitaloneshopping.com"
 95                    )
 96          ) > 0.6
 97        )
 98      )
 99    )
100    // parse out original sender domain from Apple Private Relay info
101    or (
102      sender.email.domain.domain in ("privaterelay.appleid.com", "icloud.com")
103      and strings.ilike(sender.email.local_part,
104                        '*shein_com*',
105                        '*sheinemail_com*'
106      )
107    )
108  )
109  // and the sender is not from high trust sender root domains
110  and (
111    (
112      sender.email.domain.root_domain in $high_trust_sender_root_domains
113      and not headers.auth_summary.dmarc.pass
114    )
115    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
116  )
117  and (
118    not profile.by_sender().solicited
119    or not headers.auth_summary.dmarc.pass
120    or not headers.auth_summary.spf.pass
121  )  
122attack_types:
123  - "Credential Phishing"
124  - "Spam"
125tactics_and_techniques:
126  - "Impersonation: Brand"
127  - "Social engineering"
128detection_methods:
129  - "Computer Vision"
130  - "Content analysis"
131  - "Header analysis"
132  - "Natural Language Understanding"
133  - "Optical Character Recognition"
134  - "Sender analysis"
135id: "b5843f22-9b49-56a0-a6db-259920a0c7fa"
to-top