Observed IOC: Malicious sender root domains

 1name: "Observed IOC: Malicious sender root domains"
 2description: "Detects inbound messages sent from known malicious sender root domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed."
 3type: "rule"
 4severity: "high"
 5source: |
 6  // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
 7  // Managed by automated IOC system
 8  type.inbound
 9  and hash.sha256(sender.email.domain.root_domain) in (
10    '081255ed43dc85c7ada41a02262aae3e4af4eb096e2993cb41e4bd3866256797', // Attacker-controlled domain - Recently registered domain on a privacy registrar with multiple machine generated sending local parts, delivering macro enabled spreadsheet add-in attachments in business email compromise purchase order fraud to undisclosed recipients behind a fabricated reply thread history
11    '0d5c8fb81fbe42f919341fc80f73437d1077d70f9da986e5719bd68274b42626', // Brand impersonation giveaways with AFF
12    '0f34578ba66f4dea3d964becc7cc8a1d46ad2db13679291a40ccd1383ed34872', // Attacker-controlled domain - Privacy shielded domain with its own cloud sending subdomain, delivering empty bodied messages whose subject and PDF attachment filename both splice the recipient organisation name, where the PDF carries a single view document link to a compromised third party site
13    '1cacc991e41cc9898fdb3d4e67d1ca7f88f1170c9678e3e559b343f9f668b918', // Attacker-controlled domain - Dozens of rotating role, random token and brand string local parts sending Microsoft 365 mailbox restriction credential phishing, electronic signature document lures, Social Security statement notices and shipping notifications with no legitimate traffic observed
14    '20de37dfc8b31da03bdcb457150343eba792e438e52923e708e91b59dca77bf0', // Aged domain repurposed with no legitimate traffic observed, rotating generated local parts that each address a target by its Japanese legal entity name and request the recipient reply with their personal messaging app QR code, with one shared freemail collection address tying every local part to a single campaign and a randomised mailer header
15    '223be710269bcd54ecba1acc038c7e582be8f96c6c6a4d805a7832b60de1db56', // Recently registered domain on a privacy registrar with multiple sending local parts and no legitimate traffic observed, sending German language prize reservation and parcel confirmation scams through a rotating set of dedicated tracking subdomains
16    '246b4058af66645699741f6178c7cac2e3cb06795738590b47132a56d11b17f4', // Attacker-controlled domain - Individually registered domain whose only observed use is generic role mailboxes sending pending document review credential phishing through a bulk mail platform
17    '2cf907054098f5724d09f6d47ae7790e1c91fc19b418fc68e4932335175c5229', // Second aged repurposed domain of the same inheritance advance fee operator, sharing the persona, template families and bounce return path convention across multiple sending local parts on its own gateway subdomain, with no legitimate traffic observed
18    '317abf1a85a4b088119d2dab76c558185c8ddc7c6ad3860b313d32e46e900315', // Attacker-controlled domain - Dedicated phishing tenant on a single sending subdomain where every message uses a fresh single-use random local part, running social media page takedown and copyright infringement credential phishing from a rotating subject pool, with no legitimate traffic observed
19    '3e09e73578196179a054606834b0cd7172a619f5e4702f2424dfbd0ab4d79786', // Brand impersonation giveaways with AFF
20    '4142840421051ca001a273bbbe3b9a15aea811e8b44b36a7442408e72d96e0b5', // Attacker-controlled domain - Recently registered privacy shielded typosquat that triples a letter in the impersonated crane and rigging company name, sending initial contact request for proposal reconnaissance that asks who owns project proposals before escalating
21    '4dfdaeed10736d599026e2a0014ec4b795b99c0b6add3d990829bf1a2ef41f9f', // Attacker-controlled domain - Bulk registered in the same second as sibling domains running the same campaign, sending Russian language tax and document review lures from rotating fabricated personal display names and rotating local parts that link to messaging application redirect pages on shared payload infrastructure
22    '50f6d53fafe33fa310eb4af0d9b9d855dd43a5dfad71b8c20aaaa241f5867b54', // Attacker-controlled domain - Recently registered typosquat of a US packaging manufacturer sending cloud telephony voicemail notification lures that link to a credential harvesting page carrying the target organisation name in the URL fragment
23    '5cf183ba7ab402cf2c1d23ecbce280711dbf6a2450419bd1f7879952de909f5a', // Attacker-controlled domain - Dedicated fraud tenant on a shared web host where every role mailbox authenticates as itself from a single client IP with no legitimate traffic observed, sending purchase order, quotation and request for quote fraud alongside advance fee funding solicitations, each local part routing replies to a different unrelated attacker domain
24    '62241b7477485898cdb45d9814693e9cb4989ee7bd65c2c3e205a91b84cf3fec', // Brand impersonation giveaways with AFF
25    '674b7cb4df4d9e115dd57ad0eb8227f6bb7719ef596c17a7443883718632c6ff', // Brand impersonation giveaways with AFF
26    '70d9d8baa2387a62f8819838f68f1d5990dbaf48ade37f30aed1538469d5de2c', // Attacker-controlled domain - Recently registered privacy shielded domain with its own documents and cloud sending subdomains, delivering request for quotation fraud under procedurally generated reference tokens
27    '724eba9594f52e2aeaed2e58926f8c52048accc44a15ecc0bdb5a0a101dbc268', // Brand impersonation giveaways with AFF
28    '75eadc8bf4a42082cf8b00cf4e2094c15d818b24e42dc12e82547898d02b460e', // Attacker-registered domain rotating random dictionary-word local parts for Japanese business email compromise that addresses each target by its Japanese legal entity name, with a shared reply-to collection address tying the local parts to one campaign
29    '7b1552914ae3a8bf3826ec2efe4ed79e208a22f6a39b09a50e6aacd896c56fcd', // Attacker-controlled domain - Privacy registered sibling of an identically named domain on another cheap TLD, sending payment brand and federal court secure document delivery lures whose subjects carry a shared bracketed campaign token, linking to brand logos staged on compromised third party sites
30    '7b9e3b82710b14c79b158b7e3e1c2592eec1132d513f0c6e8f2c37e159d03a21', // Compromised sending account with attacker-provisioned mailboxes alongside it, provisioned in two styles that both name the party being impersonated, one per company and one per named individual at those companies, authenticating cleanly through the domain's own cloud sending service with a self return path, running fake payment disbursement document share notifications that repeat one identical reference token across every mailbox, alongside missed phone call callback pretexts and multilingual quotation requests, with no legitimate traffic observed
31    '8c699a17e969a5781685b4485d37919eaea2990d5037fa380faf754d5afa7a21', // Attacker-controlled domain - Colonial Penn life insurance brand impersonation from rotating randomized plus-addressed local parts, using invisible character padding in the subject and display name with image-only body content and no unsubscribe or postal disclosure
32    '91d0721e7cf3646224f8e95f6b5582b83a13c483eb56423bfb585af6392df11b', // Brand impersonation giveaways with AFF
33    '94bfe99f81f1da3144f556dd68b7b5eee25f774279ced13e4bcaf6afeb135a32', // Attacker-controlled domain - Recently registered social media account verification credential phishing that substitutes a lowercase L for the leading I in the impersonated brand name, delivered from a VPS with the payload staged on a second unrelated lookalike domain
34    '9584d1db2f971f91f94a8197fea225648ffb5c4d5c1178e240c6f9768e07ee02', // Attacker-controlled domain - Random-string domain with two dedicated cloud sending subdomains, where every message uses a fresh random local part, running tax record and signature request credential phishing
35    'a40015c5fe61ff49ad076af6ad2e48ec1a46546903b6cb2b80047ee4a72f4c8e', // Brand impersonation - Google Authenticator lookalike sending fake 2FA codes and new sign-in alerts
36    'a8c8b0ee7c69c310e54d8710c3575a9e1de9a2950e6ed1806c1fe60e6cb63d36', // Brand impersonation giveaways with AFF
37    'ad5b07aab3cb7b124cdc08750b1f27d2ab888e1da585603d841a543ce7976fa8', // Attacker-controlled domain - Recently registered domain on a low cost generic top level domain using retailer themed local parts to impersonate warehouse club membership reward notifications offering a courtesy cookware set
38    'ae7ef98abc59eabb4d6ee22444c16d791f49505ea657c37f4ff5846b273cb30d', // Brand impersonation giveaways with AFF
39    'b049ed057a4c64e683ec106922d9ac00b801d9bcb63401eed0732dfe759abe6a', // Attacker-controlled domain - Privacy registered sibling of an identically named domain on another cheap TLD, sending payment brand and federal court secure document delivery lures whose subjects carry a shared bracketed campaign token, linking to brand logos staged on compromised third party sites
40    'b1f73d16e79428168bb42fc31c323a94e809a7cf7d0aa497b919362a0ac1b38e', // Attacker-controlled domain - Recently registered with junk registrant details, rotating local parts to send social media account verification eligibility lures that substitute a lowercase L for the leading I in the impersonated brand name
41    'b694a81872a328a4e25ec4d0a7e2a5c0773df94d5fddfb2974dfb60d7695bac9', // Attacker-controlled domain - Registered days before use with its own cloud sending identity, delivering fake calendar invitation subjects that splice a hex token, the target organisation name and the recipient's own address, under a display name built from the target organisation, linking to an employee survey credential harvesting redirect
42    'b91b0ef4d44fd058106de1f16ae36e573a7dee39d3458244a8b4a6e52776bafe', // Attacker-controlled domain - Recently registered site presenting as a construction bid management platform, sending bid invitation and communication preference confirmation lures that link to a credential and profile harvesting page with a per-recipient invitee identifier and token
43    'd8b437a5ab64ce273b03ac7ccfe0c15704e832c62b906e653fe0000517cdd2c7', // Attacker-controlled domain - QuickBooks and payroll notification credential phishing from synthetic personal name local parts with a randomized reference token per message and a payload hosted on a compromised third party site
44    'de6aec30308620414efd7996359baad31c118390f378fd0981916cd662f46e0c', // Attacker-controlled domain - Recently registered domain misspelling a digital services brand with multiple sending local parts and no legitimate traffic observed, sending human resources reference request credential phishing through a commercial mail service under a fabricated insurance company persona
45    'e037747f9158822e53b107ceccd12f2c015f0a7c91d12972a6c889fa0a1756e5', // Aged domain repurposed with a dedicated sending subdomain gateway and a bounce return path, with no legitimate traffic observed, running next of kin inheritance advance fee fraud under a wealth management consultant persona, addressing each recipient by full name in the subject and padding the body with zero width characters inserted inside ordinary words
46    'e1bbb6342ed70324f41fd3b3e5f6694f28af4aa24bac67b6634daecf18acbc78', // Brand impersonation giveaways with AFF
47    'e4beaafe95cdcf3d596eefa2006e77eb826efae12a693fdf83c6c8c43d92c29f', // Brand impersonation giveaways with AFF
48    'e57a39feb59185e6bb1ae0008443ef09a391537da6acfc092fbd7f9065495814', // Attacker-controlled domain - Privacy shielded domain named as bulk mail infrastructure, sending German and English language request for quotation fraud from generic infrastructure local parts
49    'f1df4d923ebbffe15bc322c92deceab0d50203114f54342f1daecb1fd8e691c9' // Attacker-controlled domain - Bulk registered in the same second as sibling domains running the same campaign, sending Russian language tax and document review lures from rotating fabricated personal display names that link to messaging application redirect pages on shared payload infrastructure
50  )  
51
52attack_types:
53  - "BEC/Fraud"
54  - "Credential Phishing"
55  - "Malware/Ransomware"
56tactics_and_techniques:
57  - "Impersonation: Domain"
58  - "Social engineering"
59detection_methods:
60  - "Sender analysis"
61  - "Header analysis"
62id: "d3e4f5a6-b7c8-4d0e-bf2a-b3c4d5e6f7a8"