Brand impersonation: Blockchain[.]com

calendar Apr 23, 2024  ยท
Share on: linkedin copy

Impersonation of Blockchain[.]com, usually for credential theft.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Blockchain[.]com"
 2description: |
 3    Impersonation of Blockchain[.]com, usually for credential theft.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8  and (
 9    regex.imatch(sender.display_name, '\bblockchain\b')
10    or strings.ilevenshtein(sender.display_name, 'blockchain') <= 1
11    or strings.ilike(sender.email.domain.domain, '*blockchain.com*')
12    or any(body.links, strings.ilevenshtein(.href_url.domain.root_domain, 'blockchain') == 1)
13  )
14  and not headers.auth_summary.spf.pass
15  and sender.email.domain.root_domain not in~ (
16    'blockchain.com',
17    'wxblockchain.com',
18    'ai-blockchain.com',
19    'envisionblockchain.com'
20  )
21  and sender.email.email not in $recipient_emails  
22attack_types:
23  - "Credential Phishing"
24tactics_and_techniques:
25  - "Impersonation: Brand"
26  - "Lookalike domain"
27  - "Social engineering"
28detection_methods:
29  - "Header analysis"
30  - "Sender analysis"
31id: "0d85e555-bf7c-50a9-afba-de3c67818b6f"
to-top