Brand impersonation: Booking.com

Detection logic

Scope: inbound message.

Detects messages purporting to be from Booking.com's support team that contain suspicious credential collection patterns. The sender is not from a legitimate Booking.com domain and shows a history of problematic behavior or lacks prior solicited communication. Additional checks enforce DMARC authentication for trusted domains.

1. inbound message
2. length(body.links) < 10
3. any of:

   • any of ml.nlu_classifier(body.current_thread.text).topics where all hold:

     • .name in ('Travel and Transportation', 'Customer Service and Support', 'Security and Authentication')
     • .confidence is not 'low'
   • all of:

     • length(body.links) is 0
     • length(attachments) is 0
     • length(body.current_thread.text) < 1000
     • sender.display_name contains 'booking.com'
4. any of:

   • any of ml.nlu_classifier(body.current_thread.text).entities where all hold:

     • .name is 'org'
     • .text is 'Booking.com'
   • body.current_thread.text contains ' booking.com '
   • sender.display_name contains 'booking.com'
   • at least 2 of:

     • body.current_thread.text contains 'Booking.com'
     • body.current_thread.text contains 'Oosterdokskade 163'
     • body.current_thread.text contains 'Amsterdam'
5. any of:

   • any of ml.nlu_classifier(body.current_thread.text).intents where:

     • .name is 'cred_theft'
   • any of body.links where any holds:

     • .display_text matches any of 7 patterns

       • *review*
       • *response*
       • *respond*
       • *complaint*
       • *contact*
       • *accommodation*
       • *view*details*
     • all of:

       • .display_url.domain.root_domain is 'booking.com'
       • .mismatched
     • .href_url.domain.root_domain is 'share.google'
     • network.whois(.href_url.domain).days_old < 30
     • .href_url.path contains '/redir'
   • body.current_thread.text matches '(?:book\\sa|open)\\srooms'
   • body.current_thread.text matches '* availab*'
   • all of:

     • any of html.xpath(body.html, '//*[text()[normalize-space()]]').nodes where:

       • .display_text is 'Booking'
     • any of html.xpath(body.html, '//*[text()[normalize-space()]]').nodes where:

       • .display_text is '.com'
6. not:

   • all of:

     • sender.email.domain.root_domain in ('booking.com', 'siteminder.com', 'thinkreservations.com')
     • headers.auth_summary.dmarc.pass
7. any of:

   • not:

     • profile.by_sender().solicited
   • all of:

     • profile.by_sender().any_messages_malicious_or_spam
     • not:

       • profile.by_sender().any_messages_benign
8. not:

   • all of:

     • sender.email.email is 'quarantine@messaging.microsoft.com'
     • any of:

       • headers.auth_summary.dmarc.pass
       • all of:

         • not:

           • coalesce(headers.auth_summary.dmarc.pass)
         • any of headers.hops where all hold:

           • .index is 0
           • any of .fields where all hold:

             • .name is 'X-MS-Exchange-CrossTenant-AuthAs'
             • .value is 'Internal'

Inspects: body.current_thread.text, body.html, body.links, body.links[].display_text, body.links[].display_url.domain.root_domain, body.links[].href_url.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].mismatched, headers.auth_summary.dmarc.pass, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, headers.hops[].index, sender.display_name, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: html.xpath, ml.nlu_classifier, network.whois, profile.by_sender, regex.icontains, strings.icontains, strings.ilike.

Indicators matched (31)