Fake-shop lure emails advertising 65% discounts on .shop domains

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•0

Detects high-volume phishing emails that utilize subjects claiming extreme discounts (e.g., 65% off) and contain links to domains ending in the .shop top-level domain (TLD). The rule correlates email subjects with URL domains and alerts when multiple recipients are targeted by the same sender/domain combination.