Sublime Security medium experimental mql

Service abuse: Amazon invitation with suspected callback phishing

Detects Amazon's no-reply address with a subject about invitation sending, containing phone numbers within HTML header elements. This pattern is commonly used to trick recipients into calling fraudulent customer service numbers.

View Source

Detection Logic

type.inbound
and sender.email.email == 'no-reply@amazon.com'
and subject.base == 'Your invitation has been sent'
and any(html.xpath(body.html, "//h2[contains(@class, 'rio-header')]").nodes,
        // phone number regex
        regex.icontains(strings.replace_confusables(.display_text),
                        '\+?(?:[ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                        '\+?(?:[ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...