sublimelowRule

Link: Recently registered .vu domain in lure

Flags inbound messages containing links that point to a .vu domain registered within the last 90 days. Observed samples span a range of lures - fake DocuSign contract requests, billing dispute notices, calendar invites, birthday and BBQ party invitations, and bidding process invites - all using freshly registered .vu domains to host malicious content while evading domain-reputation based detection.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1534 T1656 T1598.003

initial-access

Detection Query

type.inbound
and any(body.links,
        .href_url.domain.tld == "vu"
        and .href_url.domain.valid
        and network.whois(.href_url.domain).days_old < 90
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Link: Recently registered .vu domain in lure"
description: "Flags inbound messages containing links that point to a .vu domain registered within the last 90 days. Observed samples span a range of lures - fake DocuSign contract requests, billing dispute notices, calendar invites, birthday and BBQ party invitations, and bidding process invites - all using freshly registered .vu domains to host malicious content while evading domain-reputation based detection."
type: "rule"
severity: "low"
source: |
  type.inbound
  and any(body.links,
          .href_url.domain.tld == "vu"
          and .href_url.domain.valid
          and network.whois(.href_url.domain).days_old < 90
  )
tags:
  - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
  - "Spam"
tactics_and_techniques:
  - "Social engineering"
  - "Impersonation: Brand"
detection_methods:
  - "URL analysis"
  - "Whois"
id: "66133508-4ad2-5116-9346-cf18e2a14154"