Spam: Large financial amount mention from newly registered sender domain

calendar Aug 3, 2026  ·
Share on: linkedin copy

Detects inbound messages from domains less than 180 days old that solicit investment interest from named organizations or individuals on behalf of a purported private family office. Senders use financial-sounding names and rotate first names and target company names while keeping the subject line structure nearly identical. The outreach is designed to appear as a legitimate investment inquiry to bait a response.

Sublime rule (View on GitHub)

 1name: "Spam: Large financial amount mention from newly registered sender domain"
 2description: "Detects inbound messages from domains less than 180 days old that solicit investment interest from named organizations or individuals on behalf of a purported private family office. Senders use financial-sounding names and rotate first names and target company names while keeping the subject line structure nearly identical. The outreach is designed to appear as a legitimate investment inquiry to bait a response."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and network.whois(sender.email.domain).days_old < 180
 8  and any([body.html.display_text, subject.base],
 9          regex.icontains(., '\$\d\p{Pd}\$\d{1,2}(?:m\b|million)')
10  )  
11attack_types:
12  - "BEC/Fraud"
13  - "Spam"
14tactics_and_techniques:
15  - "Social engineering"
16detection_methods:
17  - "Content analysis"
18  - "Sender analysis"
19  - "Whois"
20id: "e28e1597-6a89-562e-b1e9-e551c5ac4fdd"
to-top