Brand impersonation: Squarespace

calendar Sep 11, 2025  ·
Share on: linkedin copy

Detects impersonation of Squarespace through sender display name or subject line similarity, where the sender is not from legitimate Squarespace domains or fails authentication checks.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Squarespace"
 2description: "Detects impersonation of Squarespace through sender display name or subject line similarity, where the sender is not from legitimate Squarespace domains or fails authentication checks."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    strings.icontains(sender.display_name, "squarespace")
 9    or strings.ilevenshtein(sender.display_name, "squarespace") < 2
10  )
11  // and the sender is not in org_domains or from Squarespace domains and passes auth
12  and not (
13    sender.email.domain.root_domain in $org_domains
14    or (
15      sender.email.domain.root_domain in (
16        "squarespace.com",
17        "squarespace.info",
18        "shipstation.com"
19      )
20      and headers.auth_summary.dmarc.pass
21    )
22  )
23  // negate highly trusted sender domains unless they fail DMARC authentication
24  and not (
25    sender.email.domain.root_domain in $high_trust_sender_root_domains
26    and coalesce(headers.auth_summary.dmarc.pass, false)
27  )  
28
29attack_types:
30  - "Credential Phishing"
31tactics_and_techniques:
32  - "Impersonation: Brand"
33  - "Social engineering"
34detection_methods:
35  - "Header analysis"
36  - "Sender analysis"
37id: "f806de6f-aad5-52e4-a3a3-6fb97ceab376"
to-top