Credential phishing: Fake security alert from newly registered domain

calendar Sep 17, 2026  ·
Share on: linkedin copy

Flags inbound messages from newly registered sender domains (less than 90 days old) that mimic account security notifications, referencing unusual sign-in or login activity, and containing multiple hallmark details such as IP address, device, location, or time—common indicators of credential phishing lures impersonating security alerts.

Sublime rule (View on GitHub)

 1name: "Credential phishing: Fake security alert from newly registered domain"
 2description: "Flags inbound messages from newly registered sender domains (less than 90 days old) that mimic account security notifications, referencing unusual sign-in or login activity, and containing multiple hallmark details such as IP address, device, location, or time—common indicators of credential phishing lures impersonating security alerts."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and network.whois(sender.email.domain).days_old < 90
 8  and any([subject.base, body.current_thread.text],
 9          regex.icontains(.,
10                          'unusual (?:sign[-\s]in|login)',
11                          'sign[-\s]in activity',
12                          'account security (?:notice|alert)'
13          )
14  )
15  and 2 of (
16    strings.icontains(body.current_thread.text, 'ip address:'),
17    strings.icontains(body.current_thread.text, 'device:'),
18    strings.icontains(body.current_thread.text, 'no action is required'),
19    regex.icontains(body.current_thread.text, 'location.{0,30}:'),
20    regex.icontains(body.current_thread.text, '(?:date\s(?:and|&)\s)?time:')
21  )  
22attack_types:
23  - "Credential Phishing"
24tactics_and_techniques:
25  - "Social engineering"
26  - "Impersonation: Brand"
27detection_methods:
28  - "Whois"
29  - "Content analysis"
30  - "Sender analysis"
31id: "5c0adb9b-c553-5314-9774-becb52b7dd40"
to-top