• Sublime Core Feed
Medium Severity

Attachment: EML file with IPFS links

Labels

Description

Attached EML uses engaging language and IPFS links were detected in the EML file. IPFS has been recently observed hosting phishing sites.

References

Sublime Security
Created Aug 17th, 2023 • Last updated Nov 16th, 2023
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments,
        .content_type == "message/rfc822"
        and any(file.explode(.),
                any(.scan.url.urls,
                    strings.icontains(beta.linkanalysis(.).effective_url.url,
                                      'ipfs'
                    )
                    or (
                      regex.icontains(beta.linkanalysis(.).effective_url.path,
                                      '[\.-/]ipfs|ipfs[\.-/]'
                      )
                      and beta.linkanalysis(.).effective_url.domain.domain not in $org_domains
                      and (
                        (
                          // don't include high rep domains
                          beta.linkanalysis(.).effective_url.domain.domain not in $tranco_1m
                          and beta.linkanalysis(.).effective_url.domain.domain not in $umbrella_1m
                        )
                        // if it's in Tranco or Umbrella, still include it if it's one of these
                        or beta.linkanalysis(.).effective_url.domain.domain in $free_file_hosts
                        or beta.linkanalysis(.).effective_url.domain.root_domain in $free_file_hosts
                        or beta.linkanalysis(.).effective_url.domain.root_domain in $free_subdomain_hosts
                      )
                    )
                )
        )
)

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started