Spoofed Google Drive/Meet domain TLS SNI observed - g-drive.cam

Arnold Chan@slaz

•updated 15 days ago•0•0•3

This rule monitors network traffic for TLS SNI and HTTP URI indicators associated with known typo-squatted or spoofed Google Drive and Google Meet phishing domains. It also detects the download of a specific ZIP archive used as a phishing lure.