Medium Severity
Link: /index.php Enclosed in Three Asterisks
Description
Detects messages containing a specific pattern of triple asterisks surrounding HTTP links that point to PHP index pages with query parameters, indicating potential malicious behavior. This specific pattern has been observed within messages leading to FakeAV/Tech Support scams.
References
No references.
Sublime Security
Created Jun 10th, 2025 • Last updated Jun 10th, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
and strings.count(body.current_thread.text, '* * *') == 2
and strings.contains(body.current_thread.text, ': http')
and strings.contains(body.current_thread.text, '/index.php?')
and regex.icontains(body.current_thread.text, '\* \* \*[^\r\n]+: https?:\/\/.*\/index\.php\?[a-z0-9]+[^\r\n]+\* \* \*')
Playground
Test against your own EMLs or sample data.