Recently my organisation has been flooded with phishing e-mails with different approaches: pretending to be Reddit or LinkedIn information about a new follower or package delivery status/problems, etc.
Every malicious e-mail is delivered from a different domain, they contain slightly different message body and subject, and various links.
I suspect this campaign is created with some kind of automated tool (automated domain registration, template e-mail with parameters..)
Different e-mail sender addresses, IP's and headers make it difficult to block on the e-mail server side. So I'm trying to find another solution to block this. For example, to block links these e-mails at the web filter level.
What I see similar in every e-mail is links with PHP script and two parameters: utm_source
and utm_content
http://[domain1.com]/[some-script.php]?utm_source=1&utm_content=510ad2e
http://[domain2.com]/wp-content/uploads/2021/[some-script.php]?utm_source=483edc7a&utm_content=e1ed
http://[domain3.com]/[some-script.php]?utm_source=dc3abe0&utm_content=f7a642
It still isn't a strong indicator. I think many legitimate links can also have these two parameters, but it's a start.
Does anyone know the tools that this campaign created with, or maybe some common parameters and functions it can indicate to be blocked (both on e-mail server level or web filter level)?
What common e-mail body or headers indicators can I filter on?