Spearphishing email links to TA412 BlueMoon exploit kit domains

Ankit Mehta@Secvyn

•updated Sep 10, 2026•2•0•4

This rule identifies emails containing URLs associated with known suspicious or malicious domains (secboxes.com, msbenefit.com, attcdn.com, brianwilli.com). It filters for instances where the sender's domain is not one of the identified suspicious domains to reduce noise from potential email spoofing or miscategorized communications, flagging potential phishing attempts.