Medium Severity
Attachment: EML file with IPFS links
Labels
Description
Attached EML uses engaging language and IPFS links were detected in the EML file. IPFS has been recently observed hosting phishing sites.
References
Sublime Security
Created Aug 17th, 2023 • Last updated Nov 16th, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
.content_type == "message/rfc822"
and any(file.explode(.),
any(.scan.url.urls,
strings.icontains(beta.linkanalysis(.).effective_url.url,
'ipfs'
)
or (
regex.icontains(beta.linkanalysis(.).effective_url.path,
'[\.-/]ipfs|ipfs[\.-/]'
)
and beta.linkanalysis(.).effective_url.domain.domain not in $org_domains
and (
(
// don't include high rep domains
beta.linkanalysis(.).effective_url.domain.domain not in $tranco_1m
and beta.linkanalysis(.).effective_url.domain.domain not in $umbrella_1m
)
// if it's in Tranco or Umbrella, still include it if it's one of these
or beta.linkanalysis(.).effective_url.domain.domain in $free_file_hosts
or beta.linkanalysis(.).effective_url.domain.root_domain in $free_file_hosts
or beta.linkanalysis(.).effective_url.domain.root_domain in $free_subdomain_hosts
)
)
)
)
)
Playground
Test against your own EMLs or sample data.