Detection rules › Sublime MQL
Fraudulent e-commerce operators
This attacker group engages in fraudulent activity by registering lookalike domains through Namecheap, often mimicking well-known brands by appending terms like LLC, LTD, Inc, or Corp. Their tactics involve sending fraudulent quote requests via Namecheap's private email service, followed by attempts to purchase goods on credit. These goods are routed through freight forwarders, typically bound for Western Africa. With increasing scrutiny on cash transactions to high-risk regions, they have shifted focus to acquiring goods. It is crucial to thoroughly validate any flagged messages and verify credit information before releasing products to these entities.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
| Message attribute |
|---|
| headers (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and strings.starts_with(headers.mailer, 'Open-Xchange Mailer')
and strings.ends_with(headers.message_id, '@privateemail.com>')
and regex.imatch(sender.email.domain.sld, '.*(?:llc|ltd|inc|corp|llp|co)')
and not sender.email.domain.root_domain == "simpelllc.com"
Detection logic
Scope: inbound message.
This attacker group engages in fraudulent activity by registering lookalike domains through Namecheap, often mimicking well-known brands by appending terms like LLC, LTD, Inc, or Corp. Their tactics involve sending fraudulent quote requests via Namecheap's private email service, followed by attempts to purchase goods on credit. These goods are routed through freight forwarders, typically bound for Western Africa. With increasing scrutiny on cash transactions to high-risk regions, they have shifted focus to acquiring goods. It is crucial to thoroughly validate any flagged messages and verify credit information before releasing products to these entities.
- inbound message
- headers.mailer starts with 'Open-Xchange Mailer'
- headers.message_id ends with '@privateemail.com>'
- sender.email.domain.sld matches '.*(?:llc|ltd|inc|corp|llp|co)'
not:
- sender.email.domain.root_domain is 'simpelllc.com'
Inspects: headers.mailer, headers.message_id, sender.email.domain.root_domain, sender.email.domain.sld, type.inbound. Sensors: regex.imatch, strings.ends_with, strings.starts_with.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.starts_with | prefix | Open-Xchange Mailer |
strings.ends_with | suffix | @privateemail.com> |
regex.imatch | regex | .*(?:llc|ltd|inc|corp|llp|co) |
sender.email.domain.root_domain | equals | simpelllc.com |