Detect Lookalike Domain Emails for Major Brands

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•2

This rule detects emails where the sender's address contains keywords like 'paypal', 'amazon', or 'apple' but does not originate from their official domains (e.g., '@paypal.com'). This pattern is indicative of lookalike domain phishing attempts, where attackers try to impersonate legitimate brands to trick recipients.