Operation DragonReturn Income Tax Dept Spear-Phishing Lure Detection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects potential phishing attempts by identifying emails with subject lines and attachment names related to Income Tax or official tax filings. The detection logic correlates indicators such as specific tax-related subject phrases, common tax utility attachments, suspicious URLs (govtop.one), and sender spoofing (impersonating 'Government of India' without a valid .gov.in domain).