Sublime Security low experimental mql

Brand impersonation: Ripple

Attack impersonating Ripple cryptocurrency, potentially in the form of a giveaway scam.

View Source

Detection Logic

type.inbound
and regex.imatch(sender.display_name, '\bripple\b')
and sender.email.domain.root_domain not in ("ripple.com", "ripplejobs.co.uk")

Field Validations

Loading…

Comments (0)

Loading comments...