sublimelowRule

Spam: Cold outreach from Cloudflare-hosted newly registered domain

Flags inbound messages from sender domains that were registered fewer than 365 days ago and use exactly two Cloudflare name servers with subdomains ending in '.ns'. The rule further requires that the subject or body text be classified as B2B cold outreach by the NLU model, indicating abuse of Cloudflare's free DNS infrastructure to rapidly stand up new domains for outreach-style spam.

MITRE ATT&CK

T1566 T1036 T1027 T1598

defense-evasioninitial-access

Detection Query

type.inbound
// newly registered sender domain
and network.whois(sender.email.domain).days_old < 365
// there are 2 name servers which have subdomains ending with .ns
and length(network.whois(sender.email.domain).name_servers) == 2
and all(network.whois(sender.email.domain).name_servers,
        strings.iends_with(.subdomain, '.ns')
        and .root_domain == 'cloudflare.com'
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == 'B2B Cold Outreach'
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Spam: Cold outreach from Cloudflare-hosted newly registered domain"
description: "Flags inbound messages from sender domains that were registered fewer than 365 days ago and use exactly two Cloudflare name servers with subdomains ending in '.ns'. The rule further requires that the subject or body text be classified as B2B cold outreach by the NLU model, indicating abuse of Cloudflare's free DNS infrastructure to rapidly stand up new domains for outreach-style spam."
type: "rule"
severity: "low"
source: |
  type.inbound
  // newly registered sender domain
  and network.whois(sender.email.domain).days_old < 365
  // there are 2 name servers which have subdomains ending with .ns
  and length(network.whois(sender.email.domain).name_servers) == 2
  and all(network.whois(sender.email.domain).name_servers,
          strings.iends_with(.subdomain, '.ns')
          and .root_domain == 'cloudflare.com'
  )
  and any(ml.nlu_classifier(body.current_thread.text).topics,
          .name == 'B2B Cold Outreach'
  )
  
attack_types:
  - "Spam"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Whois"
  - "Natural Language Understanding"
  - "Content analysis"
id: "ce0a2f77-7dbb-52d7-9e16-6c6ac854b783"