Brand impersonation: Blockchain[.]com

name: "Brand impersonation: Blockchain[.]com"
description: |
  Impersonation of Blockchain[.]com, usually for credential theft.
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    regex.imatch(sender.display_name, '\bblockchain\b')
    or strings.ilevenshtein(sender.display_name, 'blockchain') <= 1
    or strings.ilike(sender.email.domain.domain, '*blockchain.com*')
    or any(body.links,
           strings.ilevenshtein(.href_url.domain.root_domain, 'blockchain') == 1
    )
  )
  and not any(ml.nlu_classifier(body.current_thread.text).topics,
              .name in ("Educational and Research", "Advertising and Promotions")
              and .confidence == "high"
  )
  and not (
    sender.email.domain.root_domain in~ (
      'blockchain.com',
      'wxblockchain.com',
      'ai-blockchain.com',
      'envisionblockchain.com'
    )
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
  and not profile.by_sender_email().solicited
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Lookalike domain"
  - "Social engineering"
detection_methods:
  - "Header analysis"
  - "Sender analysis"
id: "0d85e555-bf7c-50a9-afba-de3c67818b6f"