Ousaban Malicious Webpage Geofencing/Sandbox Fingerprint Check Detected

Duo Tech@duotech

•updated Jul 2, 2026•0•0•1

This rule detects network connections, specifically DNS queries or URL hits, to the domain 'facture-in.pages.dev'. It also looks for specific, indicative language within the RemoteUrl often associated with credential harvesting or phishing landing pages (e.g., 'no_mouse', 'wrong_timezone', 'A verificar o acesso').