sublimehighRule

Fraudulent e-commerce operators

This attacker group engages in fraudulent activity by registering lookalike domains through Namecheap, often mimicking well-known brands by appending terms like LLC, LTD, Inc, or Corp. Their tactics involve sending fraudulent quote requests via Namecheap's private email service, followed by attempts to purchase goods on credit. These goods are routed through freight forwarders, typically bound for Western Africa. With increasing scrutiny on cash transactions to high-risk regions, they have shifted focus to acquiring goods. It is crucial to thoroughly validate any flagged messages and verify credit information before releasing products to these entities.

MITRE ATT&CK

T1566.002 T1534 T1656 T1598.003 T1583.001 T1566 T1598

initial-access

Detection Query

type.inbound
and strings.starts_with(headers.mailer, 'Open-Xchange Mailer')
and strings.ends_with(headers.message_id, '@privateemail.com>')
and regex.imatch(sender.email.domain.sld, '.*(?:llc|ltd|inc|corp|llp|co)')
and not sender.email.domain.root_domain == "simpelllc.com"

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Fraudulent e-commerce operators"
description: "This attacker group engages in fraudulent activity by registering lookalike domains through Namecheap, often mimicking well-known brands by appending terms like LLC, LTD, Inc, or Corp. Their tactics involve sending fraudulent quote requests via Namecheap's private email service, followed by attempts to purchase goods on credit. These goods are routed through freight forwarders, typically bound for Western Africa. With increasing scrutiny on cash transactions to high-risk regions, they have shifted focus to acquiring goods. It is crucial to thoroughly validate any flagged messages and verify credit information before releasing products to these entities."
type: "rule"
severity: "high"
source: |
  type.inbound
  and strings.starts_with(headers.mailer, 'Open-Xchange Mailer')
  and strings.ends_with(headers.message_id, '@privateemail.com>')
  and regex.imatch(sender.email.domain.sld, '.*(?:llc|ltd|inc|corp|llp|co)')
  and not sender.email.domain.root_domain == "simpelllc.com"

attack_types:
  - "BEC/Fraud"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Lookalike domain"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Sender analysis"
id: "3776a6fc-73b6-59e3-89c9-317eba43755c"