Observed IOC: Malicious root domains in body links

calendar Sep 4, 2026  ·
Share on: linkedin copy

Detects inbound messages containing links to known malicious root domains in the message body. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

Sublime rule (View on GitHub)

 1name: "Observed IOC: Malicious root domains in body links"
 2description: "Detects inbound messages containing links to known malicious root domains in the message body. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed."
 3type: "rule"
 4severity: "high"
 5source: |
 6  // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
 7  // Managed by automated IOC system
 8  type.inbound
 9  and any(body.current_thread.links,
10          hash.sha256(.href_url.domain.root_domain) in (
11            '0defae6129a85bea445da8c8c890caf065ba48ff13bc901e7dd51663251ab507', // Fake voicemail notification credential phishing infrastructure
12            'ee7c8613ad19ce2148ab3f305a99d85e2f299a67fb763c4d3ac15cce76949c38', // Fake voicemail notification credential phishing infrastructure
13            'ff09b48f176b08a19ae3301af5aa07a4c930526db8abcac16297d9c300e030e2' // Google lookalike credential phishing infrastructure
14          )
15  )  
16
17attack_types:
18  - "Credential Phishing"
19  - "Malware/Ransomware"
20tactics_and_techniques:
21  - "Evasion"
22  - "Social engineering"
23detection_methods:
24  - "URL analysis"
25  - "Content analysis"
26id: "f5a6b7c8-d9e0-4f2a-9b4c-d5e6f7a8b9c0"
to-top