Enhance spam detection for fake dating profiles

[peterdj45]

Description

adding check for suspicious keywords in link path and display text

Associated samples

• https://platform.sublime.security/messages/5008c534250839b2f5fc747e037cb5b97174eb685e8e6a3d6c54cb81dfd7cc36
• https://platform.sublime.security/messages/5008d4e6c4e2a7c9135339d30ec67e12b70400adc311b9c7f023cca57e1b9214
• https://platform.sublime.security/messages/5008a46507f28d658ac3bf7c4f89df83e3a58709e64251e05118f836314815d1

Associated hunts

• https://platform.sublime.security/messages/hunt?huntId=019c460b-409f-7478-ac28-900253f466ac - hunt for net new coverage

[peterdj45]

/mql-mimic-exempt 816987, 816981, 816982, 816993, 816980, 816983, 816984, 816985, 816992, 816995, 816999, 816996, 816998, 817002, 879772, 935082, 935084, 935083, 935080, 935085, 935086, 935088, 935087, 935091, 935090, 935093, 935092, 935094, 935095, 935097, 935100, 935096, 935098, 935101, 935099, 935102, 935103, 935104, 935108, 935105, 935106, 935111, 935113, 935114, 935112, 935115, 935116, 935117, 935118, 936807, 936811, 936808, 936810, 936809, 936813, 936814, 936815, 941632, 941667, 941647, 941663, 941671, 950578, 941697, 941708, 941718, 941726, 941728

These were all received more than a year ago (the rule itself is only a few months old).

[IndiaAce]

500eed53234a38abf42091c9b8069cbcd1803204285213b30bc7d2f10e7a7de7

quick check on stuff like this... I think it could probably be reviewed? "Women's clinic"

[peterdj45]

500eed53234a38abf42091c9b8069cbcd1803204285213b30bc7d2f10e7a7de7

quick check on stuff like this... I think it could probably be reviewed? "Women's clinic"

Ack, good catch! I think we should just drop women from the NLU org check altogether.

[IndiaAce]

500eed53234a38abf42091c9b8069cbcd1803204285213b30bc7d2f10e7a7de7
quick check on stuff like this... I think it could probably be reviewed? "Women's clinic"

Ack, good catch! I think we should just drop women from the NLU org check altogether.

hmmmm I'm honestly not really sure? I think we could keep it in since it looks like it does help match on some stuff, like this example: 50086906732f90dc8f14c4a59b2ddf61c58047b46ba415369c338fe76db57b5c also this one doesn't match but it's kind of in the same realm? I kind of like the idea of this being it's own detection too for this specific "campaign" lmk your thoughts.