TONResolver Phishing — Booking.com Impersonation with photo-*.cfd Links
Detects phishing emails impersonating Booking.com, specifically targeting Japanese users with malicious .cfd domains, suspicious subject lines, or attachments like 'invite.ics'. The rule assigns risk scores based on specific indicators such as URL patterns, body text, and sender domains.
Splunk (SPL)
