Brand impersonation: Blockchain[.]com

calendar Nov 13, 2023  ยท
Share on: linkedin copy

Impersonation of Blockchain[.]com, usually for credential theft.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Blockchain[.]com"
 2description: |
 3    Impersonation of Blockchain[.]com, usually for credential theft.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8  and (
 9    regex.imatch(sender.display_name, '\bblockchain\b')
10    or strings.ilevenshtein(sender.display_name, 'blockchain') <= 1
11    or strings.ilike(sender.email.domain.domain, '*blockchain.com*')
12    or any(body.links, strings.ilevenshtein(.href_url.domain.root_domain, 'blockchain') == 1)
13  )
14  and any(distinct(headers.hops, .authentication_results.spf is not null),
15          strings.like(.authentication_results.spf, "*fail")
16  )
17  and sender.email.domain.root_domain not in~ (
18    'blockchain.com',
19    'wxblockchain.com',
20    'ai-blockchain.com',
21    'envisionblockchain.com'
22  )
23  and sender.email.email not in $recipient_emails  
24attack_types:
25  - "Credential Phishing"
26tactics_and_techniques:
27  - "Impersonation: Brand"
28  - "Lookalike domain"
29  - "Social engineering"
30detection_methods:
31  - "Header analysis"
32  - "Sender analysis"
33id: "0d85e555-bf7c-50a9-afba-de3c67818b6f"
to-top