From 4640949f83a7c78b0a53c984a0aa13c2755f706c Mon Sep 17 00:00:00 2001 From: "Brandon 2: Brandon Harder" <189403278+missingn0pe@users.noreply.github.com> Date: Wed, 2 Sep 2026 11:50:24 -0500 Subject: [PATCH 1/2] Create spam_hostinger_dns_parking_newly_registered_domain.yml Rule flags on newly registered sender domains less than 365 days old, using Hostinger's default DNS name servers. --- ...er_dns_parking_newly_registered_domain.yml | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 detection-rules/spam_hostinger_dns_parking_newly_registered_domain.yml diff --git a/detection-rules/spam_hostinger_dns_parking_newly_registered_domain.yml b/detection-rules/spam_hostinger_dns_parking_newly_registered_domain.yml new file mode 100644 index 00000000000..f8073b53228 --- /dev/null +++ b/detection-rules/spam_hostinger_dns_parking_newly_registered_domain.yml @@ -0,0 +1,40 @@ +name: "Spam: Cold outreach from Hostinger-hosted newly registered domain" +description: "Detects inbound messages from domains registered less than 365 days ago using Hostinger (dns-parking.com) nameservers, where the message content is classified as B2B cold outreach by NLU analysis. The rule excludes legitimate reply threads, and only flags senders who are either unsolicited or have a history of malicious/spam activity without any benign messages." +type: "rule" +severity: "low" +source: | + type.inbound + // newly registered sender domain + and network.whois(sender.email.domain).days_old < 365 + + // there are 2 name servers which have subdomains containing .ns + and length(network.whois(sender.email.domain).name_servers) == 2 + and all(network.whois(sender.email.domain).name_servers, + strings.istarts_with(.subdomain, 'ns') + and .root_domain == 'dns-parking.com' + ) + + // nlu logic + and any(ml.nlu_classifier(body.current_thread.text).topics, + .name == 'B2B Cold Outreach' + ) + + // sender profiles + and ( + not profile.by_sender_email().solicited + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_messages_benign + ) + ) + +tags: + - "Attack surface reduction" +attack_types: + - "Spam" +tactics_and_techniques: + - "Social engineering" +detection_methods: + - "Whois" + - "Natural Language Understanding" + - "Sender analysis" From 19c9884a848979809e0305a5233cdfbdf463b9d0 Mon Sep 17 00:00:00 2001 From: CI Bot Date: Wed, 2 Sep 2026 16:52:53 +0000 Subject: [PATCH 2/2] Auto-format MQL and add rule IDs --- .../spam_hostinger_dns_parking_newly_registered_domain.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/spam_hostinger_dns_parking_newly_registered_domain.yml b/detection-rules/spam_hostinger_dns_parking_newly_registered_domain.yml index f8073b53228..332718f6eb2 100644 --- a/detection-rules/spam_hostinger_dns_parking_newly_registered_domain.yml +++ b/detection-rules/spam_hostinger_dns_parking_newly_registered_domain.yml @@ -38,3 +38,4 @@ detection_methods: - "Whois" - "Natural Language Understanding" - "Sender analysis" +id: "d88e2669-e2f6-5b25-8fc0-4132f03b3c48"