Link: Recently registered .vu domain in lure

calendar Aug 28, 2026 · Attack surface reduction  ·
Share on: linkedin copy

Flags inbound messages containing links that point to a .vu domain registered within the last 90 days. Observed samples span a range of lures - fake DocuSign contract requests, billing dispute notices, calendar invites, birthday and BBQ party invitations, and bidding process invites - all using freshly registered .vu domains to host malicious content while evading domain-reputation based detection.

Sublime rule (View on GitHub)

 1name: "Link: Recently registered .vu domain in lure"
 2description: "Flags inbound messages containing links that point to a .vu domain registered within the last 90 days. Observed samples span a range of lures - fake DocuSign contract requests, billing dispute notices, calendar invites, birthday and BBQ party invitations, and bidding process invites - all using freshly registered .vu domains to host malicious content while evading domain-reputation based detection."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.tld == "vu"
 9          and .href_url.domain.valid
10          and network.whois(.href_url.domain).days_old < 90
11  )  
12tags:
13  - "Attack surface reduction"
14attack_types:
15  - "Credential Phishing"
16  - "BEC/Fraud"
17  - "Spam"
18tactics_and_techniques:
19  - "Social engineering"
20  - "Impersonation: Brand"
21detection_methods:
22  - "URL analysis"
23  - "Whois"
24id: "66133508-4ad2-5116-9346-cf18e2a14154"

Related rules

to-top