Brand impersonation: Blockchain[.]com
Impersonation of Blockchain[.]com, usually for credential theft.
Sublime rule (View on GitHub)
1name: "Brand impersonation: Blockchain[.]com"
2description: |
3 Impersonation of Blockchain[.]com, usually for credential theft.
4type: "rule"
5severity: "medium"
6source: |
7 type.inbound
8 and (
9 regex.imatch(sender.display_name, '\bblockchain\b')
10 or strings.ilevenshtein(sender.display_name, 'blockchain') <= 1
11 or strings.ilike(sender.email.domain.domain, '*blockchain.com*')
12 or any(body.links, strings.ilevenshtein(.href_url.domain.root_domain, 'blockchain') == 1)
13 )
14 and any(distinct(headers.hops, .authentication_results.spf is not null),
15 strings.like(.authentication_results.spf, "*fail")
16 )
17 and sender.email.domain.root_domain not in~ (
18 'blockchain.com',
19 'wxblockchain.com',
20 'ai-blockchain.com',
21 'envisionblockchain.com'
22 )
23 and sender.email.email not in $recipient_emails
24attack_types:
25 - "Credential Phishing"
26tactics_and_techniques:
27 - "Impersonation: Brand"
28 - "Lookalike domain"
29 - "Social engineering"
30detection_methods:
31 - "Header analysis"
32 - "Sender analysis"
33id: "0d85e555-bf7c-50a9-afba-de3c67818b6f"