High Severity
Brand impersonation: Apple
Description
Impersonation of Apple.
References
Sublime Security
Created Aug 17th, 2023 • Last updated Aug 21st, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and (
sender.display_name =~ 'apple developer'
or strings.ilevenshtein(sender.display_name, 'apple developer') <= 2
)
and sender.email.domain.root_domain !~ 'apple.com'
and sender.email.email not in $recipient_emails
Playground
Test against your own EMLs or sample data.