Phishing lure emails advertising ~65% discounts linking to .shop domains

Arnold Chan@slaz

•updated Sep 10, 2026•1•0•4

Detects high-volume, potentially malicious email campaigns characterized by discount-themed subject lines containing keywords like '65% off' and links pointing to '.shop' domains. The rule identifies suspicious patterns by aggregating events and flagging instances where multiple users are targeted with similar subjects and domains, excluding those specifically allowlisted.