Sublime Security high experimental mql

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure

Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.

View Source

Detection Logic

type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(body.links,
        // eviltokens cloudflare workers domain struct
        (
          strings.iends_with(.href_url.domain.domain, '-account.workers.dev')
          and regex.icontains(.href_url.domain.domain,
                              '^(?:(?:page-)?adobe
| calendar_invite
| (?:page-)?docusign
| fax
| quarantine
| onedrive
| page-password
| sharepoint
| voicemail
| index)-[a-z0-9]{3}\.[a-z0-9-]{3,}'
          )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...