sublimemediumRule

Service abuse: Fake loan/funding verification lure via Mailgun

Detects inbound messages sent via Mailgun's sending infrastructure (mg subdomain) from common bulk sender addresses, where the body contains unresolved template placeholders like '[SOURCEID]', known Mailgun-associated physical addresses, or links pointing to Mailgun's campaign/list management subdomain (napp) on the same root domain as the sender. These indicators suggest automated bulk distribution with incomplete template rendering or suspicious infrastructure usage.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and sender.email.local_part in~ ("info", "no-reply", "noreply")
and sender.email.domain.subdomain == "mg"
and (
  any(body.links,
      .href_url.domain.subdomain == "napp"
      and .href_url.domain.root_domain == sender.email.domain.root_domain
      and (
        strings.istarts_with(.href_url.path, "/campaigns/")
        or strings.istarts_with(.href_url.path, "/lists/")
      )
  )
  or strings.icontains(body.current_thread.text,
                       "12603 State Route 143 Suite G",
                       "4049 US Highway 231 #2002 Wetumpka, AL 36093"
  )
  or strings.icontains(body.current_thread.text, "[SOURCEID]")
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Service abuse: Fake loan/funding verification lure via Mailgun"
description: "Detects inbound messages sent via Mailgun's sending infrastructure (mg subdomain) from common bulk sender addresses, where the body contains unresolved template placeholders like '[SOURCEID]', known Mailgun-associated physical addresses, or links pointing to Mailgun's campaign/list management subdomain (napp) on the same root domain as the sender. These indicators suggest automated bulk distribution with incomplete template rendering or suspicious infrastructure usage."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and sender.email.local_part in~ ("info", "no-reply", "noreply")
  and sender.email.domain.subdomain == "mg"
  and (
    any(body.links,
        .href_url.domain.subdomain == "napp"
        and .href_url.domain.root_domain == sender.email.domain.root_domain
        and (
          strings.istarts_with(.href_url.path, "/campaigns/")
          or strings.istarts_with(.href_url.path, "/lists/")
        )
    )
    or strings.icontains(body.current_thread.text,
                         "12603 State Route 143 Suite G",
                         "4049 US Highway 231 #2002 Wetumpka, AL 36093"
    )
    or strings.icontains(body.current_thread.text, "[SOURCEID]")
  ) 
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Sender analysis"
  - "URL analysis"
  - "Content analysis"
id: "53d13e00-48b7-542d-bb06-8b8d316229a3"