Scam: Fake estate sale offering welding equipment and tools
Detects fraudulent messages impersonating someone selling inherited or estate items, specifically targeting welding equipment, power tools, and machinery. These messages typically claim items are from a deceased relative's estate or due to relocation, require shipping arrangements, and use emotional manipulation to appear legitimate while requesting contact through alternative channels.
Sublime rule (View on GitHub)
1name: "Scam: Fake estate sale offering welding equipment and tools"
2description: "Detects fraudulent messages impersonating someone selling inherited or estate items, specifically targeting welding equipment, power tools, and machinery. These messages typically claim items are from a deceased relative's estate or due to relocation, require shipping arrangements, and use emotional manipulation to appear legitimate while requesting contact through alternative channels."
3type: "rule"
4severity: "high"
5source: |
6 length(body.current_thread.links) < 10
7 and length(body.current_thread.text) < 3000
8 and (
9 regex.icontains(body.current_thread.text,
10 '(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)\s*[^\r\n]{0,50}(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)',
11 '(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)\s*[^\r\n]{0,50}(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)'
12 )
13 or regex.icontains(body.current_thread.text,
14 '(?:Caterpillar|\bCAT\b|John\s*Deere|Kubota|Bobcat|Honda|Generac|Stihl|Husqvarna|\bToro\b)\s*[^\r\n]{0,50}(?:\bgenerator\b|\bchainsaw\b|\bexcavator\b|\bskid\s*steer\b|\btractor\b|\bmower\b|\bloader\b|\bbackhoe\b)'
15 )
16 or regex.icontains(body.current_thread.text,
17 '(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)\s*[^\r\n]{0,50}(?:available|sale|rehome|gift|giving\s*away|free)',
18 '(?:available|sale|rehome|gift|giving\s*away|free)\s*[^\r\n]{0,50}(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)'
19 )
20 or strings.ilike(body.current_thread.text,
21 '*welding tools*',
22 '*tools and accessories*'
23 )
24 or (
25 length(regex.extract(body.current_thread.text,
26 '(?i)(?:generator|refrigerator|trailer|tractor|lawnmower|mower|washer|dryer|freezer|treadmill|peloton|vanity|dresser|couch|sectional|kennel|mattress|bed\s*frame|hot\s*tub|golf\s*cart|tv|gazebo|loveseat|dishwasher|microwave|kitchenaid|rolex|watch|honda|toyota|ford|chevy|jeep|kubota|bobcat|polaris|kawasaki|macbook|iphone|playstation|ps5|xbox|canon|sony|dji|piano|keyboard|guitar|violin)\b[^\r\n]{0,30}(?:\(\s*\d{2,5}\s*\)|\$\s*\d{2,5}|\bfor\s+\$?\d{2,5})'
27 )
28 ) >= 5
29 and regex.icontains(body.current_thread.text,
30 'late (?:husband|father|dad|wife|mother|mom)',
31 '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate'
32 )
33 )
34 )
35 and (
36 regex.icontains(body.current_thread.text,
37 'late (?:husband|father|dad|wife|mother|mom)',
38 '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate',
39 'inherited instruments',
40 'just lost (?:her|his|their) (?:husband|father|dad|wife|mother|mom)'
41 )
42 or strings.ilike(body.current_thread.text,
43 '* downsizing *',
44 '* relocating soon *',
45 '* to relocate *',
46 '*prepares to relocate*',
47 '*relocate with*family*'
48 )
49 or strings.ilike(body.current_thread.text,
50 '*sponsored*giveaway*',
51 '*giveaway*sponsored*',
52 '* generously offering *',
53 '* generous offer *',
54 '*a loving home*',
55 '*a good home*',
56 '*find a new home *',
57 '*rehome these instruments *',
58 '* free donation*'
59 )
60 or regex.icontains(body.current_thread.text,
61 'giv\w+\s+away\s+(?:her|his|their|my|our)\s+(?:late|deceased|dad|father|mother|husband|wife)',
62 'giv\w+\s+away\s+(?:her|his|their|my|our)[^\r\n]{0,40}(?:tool|welder|welding|equipment|instrument|machine)'
63 )
64 or strings.ilike(body.current_thread.text,
65 '*generous opportunity*',
66 '*who needs a reliable*',
67 '*comprehensive set of tools*',
68 '*top-of-the-line machine*'
69 )
70 )
71 and (
72 regex.icontains(body.current_thread.text,
73 'shipping (?:fee|cost|arrangement)',
74 '(?:responsible|pay) for shipping',
75 'no (?:local\s)?pick.?up',
76 '(?:local\s)?pick.?up.{0,50}not available',
77 'delivery only',
78 'moving company'
79 )
80 or strings.ilike(body.current_thread.text,
81 '* if you will take it *',
82 '* or have someone *',
83 '* indicate your interest *',
84 '* to someone you know *',
85 '* know someone who *',
86 '* someone you know would *',
87 '* someone who will *',
88 '* someone who truly *',
89 '* anyone you know *'
90 )
91 or regex.icontains(body.current_thread.text,
92 'if you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested',
93 '(?:any|some)one[^\r\n]{0,20}(is|will|would|might be)[^\r\n]{0,20}interested',
94 'who (?:will|would|might) appreciate'
95 )
96 or (
97 any(regex.extract(body.current_thread.text,
98 "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
99 ),
100 strings.parse_email(.full_match).domain.domain in $free_email_providers
101 or strings.parse_email(.full_match).domain.root_domain in $free_email_providers
102 )
103 or (
104 length(headers.reply_to) > 0
105 and sender.email.email not in map(headers.reply_to, .email.email)
106 )
107 or length(recipients.to) == 0
108 or regex.icontains(body.current_thread.text,
109 '(?:call|contact|text)[^\r\n]{0,50} at'
110 )
111 or regex.icontains(body.current_thread.text,
112 '(?:private|personal|primary) (?:e-?)?mail'
113 )
114 or strings.icontains(body.current_thread.text,
115 'happy to answer any questions you may have'
116 )
117 or strings.icontains(body.current_thread.text, ' kindly ')
118 or strings.icontains(body.current_thread.text, ' (kindly ')
119 )
120 )
121attack_types:
122 - "BEC/Fraud"
123tactics_and_techniques:
124 - "Social engineering"
125 - "Free email provider"
126 - "Out of band pivot"
127detection_methods:
128 - "Content analysis"
129 - "Sender analysis"
130 - "Header analysis"
131id: "44cb8704-7756-5d8a-817e-a038c693ae08"