Browse Rules

Flare lookalike domain results

'This query searches for lookalike domains and SSL certificate registrations.'

Lookalike sender domain (untrusted sender)

Sender's domain is a lookalike of one of your organization's domains and is untrusted.

Brand impersonation: Spotify

Impersonation of Spotify.

Brand impersonation: Twitter

Impersonation of Twitter.

Brand impersonation: Vanta

Impersonation of Vanta.

Brand impersonation: Venmo

Impersonation of Venmo

Punycode sender domain

The sender's domain contains punycode, a technique used by attackers to impersonate legitimate domains.

Suspected lookalike domain with suspicious language

This rule identifies messages where links use typosquatting or lookalike domains similar to the sender domain, with at least one domain being either unregistered or recently registered (≤90 days). The messages must also contain indicators of business email compromise (BEC), credential theft, or abusive language patterns like financial terms or polite phrasing such as kindly. This layered approach targets phishing attempts combining domain deception with manipulative content

Brand impersonation: DocSend

Attack impersonating DocSend.

Brand impersonation: Github

Impersonation of Github.

Brand impersonation: LinkedIn

Impersonation of LinkedIn.

Brand impersonation: Netflix

Impersonation of Netflix.

Brand impersonation: Charles Schwab

Impersonation of Charles Schwab & Co

Brand impersonation: DHL

Impersonation of the shipping provider DHL.

Brand impersonation: DigitalOcean

Impersonation of the cloud provider DigitalOcean.

Brand impersonation: FedEx

Impersonation of the shipping provider FedEx.

Brand impersonation: Sublime Security

Possible attempt to impersonate Sublime Security executives.

Brand impersonation: Wells Fargo

Impersonation of Wells Fargo Bank.

Brand Impersonation: Stripe

Impersonation of Stripe, usually for credential theft.

Brand impersonation: FINRA

Impersonation of the Financial Industry Regulatory Authority (FINRA)

Brand impersonation: Silicon Valley Bank

Detects emails that impersonate Silicon Valley Bank

Infoblox - TI - InfobloxCDC Match Found - Lookalike Domains

'InfobloxCDC Lookalike Domain match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).'

Brand impersonation: Barracuda Networks

Impersonation of Barracuda Networks, an IT security company.

Brand impersonation: Blockchain.com

Impersonation of Blockchain.com, usually for credential theft.

Brand impersonation: Hulu

Impersonation of Hulu.