Scam: Fake estate sale offering welding equipment and tools
Detects fraudulent messages impersonating someone selling inherited or estate items, specifically targeting welding equipment, power tools, and machinery. These messages typically claim items are from a deceased relative's estate or due to relocation, require shipping arrangements, and use emotional manipulation to appear legitimate while requesting contact through alternative channels.
Sublime rule (View on GitHub)
1name: "Scam: Fake estate sale offering welding equipment and tools"
2description: "Detects fraudulent messages impersonating someone selling inherited or estate items, specifically targeting welding equipment, power tools, and machinery. These messages typically claim items are from a deceased relative's estate or due to relocation, require shipping arrangements, and use emotional manipulation to appear legitimate while requesting contact through alternative channels."
3type: "rule"
4severity: "high"
5source: |
6 length(body.current_thread.links) < 10
7 and length(body.current_thread.text) < 3000
8 and (
9 regex.icontains(body.current_thread.text,
10 '(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)\s*[^\r\n]{0,50}(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)',
11 '(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)\s*[^\r\n]{0,50}(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)'
12 )
13 or regex.icontains(body.current_thread.text,
14 '(?:Caterpillar|\bCAT\b|John\s*Deere|Kubota|Bobcat|Honda|Generac|Stihl|Husqvarna|\bToro\b)\s*[^\r\n]{0,50}(?:\bgenerator\b|\bchainsaw\b|\bexcavator\b|\bskid\s*steer\b|\btractor\b|\bmower\b|\bloader\b|\bbackhoe\b)'
15 )
16 or regex.icontains(body.current_thread.text,
17 '(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)\s*[^\r\n]{0,50}(?:available|sale|rehome|gift|giving\s*away|free)',
18 '(?:available|sale|rehome|gift|giving\s*away|free)\s*[^\r\n]{0,50}(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)'
19 )
20 or strings.ilike(body.current_thread.text,
21 '*welding tools*',
22 '*tools and accessories*'
23 )
24 or (
25 length(regex.extract(body.current_thread.text,
26 '(?i)(?:generator|refrigerator|trailer|tractor|lawnmower|mower|washer|dryer|freezer|treadmill|peloton|vanity|dresser|couch|sectional|kennel|mattress|bed\s*frame|hot\s*tub|golf\s*cart|tv|gazebo|loveseat|dishwasher|microwave|kitchenaid|rolex|watch|honda|toyota|ford|chevy|jeep|kubota|bobcat|polaris|kawasaki|macbook|iphone|playstation|ps5|xbox|canon|sony|dji|piano|keyboard|guitar|violin)\b[^\r\n]{0,30}(?:\(\s*\d{2,5}\s*\)|\$\s*\d{2,5}|\bfor\s+\$?\d{2,5})'
27 )
28 ) >= 5
29 and regex.icontains(body.current_thread.text,
30 'late (?:husband|father|dad|wife|mother|mom)',
31 '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate'
32 )
33 )
34 )
35 and (
36 regex.icontains(body.current_thread.text,
37 'late (?:husband|father|dad|wife|mother|mom)',
38 '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate',
39 'inherited instruments',
40 '(?:just\s)?(?:lost|loss of) (?:her|his|their) (?:husband|father|dad|wife|mother|mom)'
41 )
42 or strings.ilike(body.current_thread.text,
43 '* downsizing *',
44 '* relocating soon *',
45 '* to relocate *',
46 '*prepares to relocate*',
47 '*relocate with*family*'
48 )
49 or strings.ilike(body.current_thread.text,
50 '*sponsored*giveaway*',
51 '*giveaway*sponsored*',
52 '* generously offering *',
53 '* generous offer *',
54 '*a loving home*',
55 '*a good home*',
56 '*find a new home *',
57 '*rehome these instruments *',
58 '* free donation*'
59 )
60 or regex.icontains(body.current_thread.text,
61 'giv\w+\s+away\s+(?:her|his|their|my|our)\s+(?:late|deceased|dad|father|mother|husband|wife)',
62 'giv\w+\s+away\s+(?:her|his|their|my|our)[^\r\n]{0,40}(?:tool|welder|welding|equipment|instrument|machine)'
63 )
64 or strings.ilike(body.current_thread.text,
65 '*generous opportunity*',
66 '*who needs a reliable*',
67 '*comprehensive set of tools*',
68 '*top-of-the-line machine*',
69 '* refundable deposit*'
70 )
71 )
72 and (
73 regex.icontains(body.current_thread.text,
74 'shipping (?:fee|cost|arrangement)',
75 '(?:responsible|pay) for shipping',
76 'no (?:local\s)?pick.?up',
77 '(?:local\s)?pick.?up.{0,50}not available',
78 'delivery only',
79 'moving company'
80 )
81 or strings.ilike(body.current_thread.text,
82 '* if you will take it *',
83 '* or have someone *',
84 '* indicate your interest *',
85 '* to someone you know *',
86 '* know someone who *',
87 '* someone you know would *',
88 '* someone who will *',
89 '* someone who truly *',
90 '* anyone you know *'
91 )
92 or regex.icontains(body.current_thread.text,
93 'if you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested',
94 '(?:any|some)one[^\r\n]{0,20}(is|will|would|might be)[^\r\n]{0,20}interested',
95 'who (?:will|would|might) appreciate'
96 )
97 or (
98 any(regex.extract(body.current_thread.text,
99 "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
100 ),
101 strings.parse_email(.full_match).domain.domain in $free_email_providers
102 or strings.parse_email(.full_match).domain.root_domain in $free_email_providers
103 )
104 or (
105 length(headers.reply_to) > 0
106 and sender.email.email not in map(headers.reply_to, .email.email)
107 )
108 or length(recipients.to) == 0
109 or regex.icontains(body.current_thread.text,
110 '(?:call|contact|text)[^\r\n]{0,50} at'
111 )
112 or regex.icontains(body.current_thread.text,
113 '(?:private|personal|primary) (?:e-?)?mail'
114 )
115 or strings.icontains(body.current_thread.text,
116 'happy to answer any questions you may have'
117 )
118 or strings.icontains(body.current_thread.text, ' kindly ')
119 or strings.icontains(body.current_thread.text, ' (kindly ')
120 )
121 )
122attack_types:
123 - "BEC/Fraud"
124tactics_and_techniques:
125 - "Social engineering"
126 - "Free email provider"
127 - "Out of band pivot"
128detection_methods:
129 - "Content analysis"
130 - "Sender analysis"
131 - "Header analysis"
132id: "44cb8704-7756-5d8a-817e-a038c693ae08"