T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain

DNS resolution of a domain matching the ShinyHunters "The Com" claims-impersonation campaign naming grammar: a victim brand rendered as <brand>.claims, <brand>-claims.com, claims-<brand>.com, or us-<brand>.com. The campaign registers these through Dynadot, fronts them with Cloudflare, and provisions a same-day Google Trust Services certificate with no MX record; the network-observable tail of that acquired infrastructure is a client resolving the name. The .claims TLD is a small Identity Digital namespace dominated by abuse (per Flare, roughly a third of first-half-August registrations belonged to this one operator), so a query into it warrants review against an allowlist of the organization's own legitimately registered names. The -claims.com and claims- constructions are noisier because legitimate insurance and claims-processing domains use them, so they are scoped and should be tuned per environment. This rule is the resolver-layer complement to the certificate-transparency watch described in the research; blocking the name is cheap before a page is served and is the one control point a defender holds outright when delivery is by phone rather than email.

Rule ID

0623d53d-7bf8-4412-bc11-9f3cdda81b2d

Status

experimental

Level

medium

Log source

category: dns

Date

2026-09-12

Modified

2026-09-12

ATT&CK

T1566.004 , T1583.001 (signal rollup)

Canonical YAML

t1583-001-claims-registration-conjunction.yml

References

• https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/
• https://attack.mitre.org/techniques/T1583/001/
• https://health-isac.org/urgent-threat-alert-shinyhunters-vishing-campaigns-and-domain-impersonation/

False positives

• Legitimate registrants in the .claims TLD, including insurers and claims administrators who own their own brand under it and organizations that defensively registered their name after the August 2026 advisories. Allowlist your own and known-partner .claims names before promoting past experimental.
• Legitimate insurance, warranty, and claims-processing services that operate under <brand>-claims.com or claims-<brand>.com names. This is the noisy half of the rule; scope selection_claims_com to unresolved or newly observed domains, or drop it and keep only the .claims TLD selection in mail-heavy environments.
• Threat-intelligence, brand-protection, and security tooling that resolves lookalike domains as part of monitoring. Exclude the resolving hosts.

Rule YAML

title: 'T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain'
id: '0623d53d-7bf8-4412-bc11-9f3cdda81b2d'
status: 'experimental'
description: 'DNS resolution of a domain matching the ShinyHunters "The Com" claims-impersonation campaign naming grammar: a victim brand rendered as <brand>.claims, <brand>-claims.com, claims-<brand>.com, or us-<brand>.com. The campaign registers these through Dynadot, fronts them with Cloudflare, and provisions a same-day Google Trust Services certificate with no MX record; the network-observable tail of that acquired infrastructure is a client resolving the name. The .claims TLD is a small Identity Digital namespace dominated by abuse (per Flare, roughly a third of first-half-August registrations belonged to this one operator), so a query into it warrants review against an allowlist of the organization''s own legitimately registered names. The -claims.com and claims- constructions are noisier because legitimate insurance and claims-processing domains use them, so they are scoped and should be tuned per environment. This rule is the resolver-layer complement to the certificate-transparency watch described in the research; blocking the name is cheap before a page is served and is the one control point a defender holds outright when delivery is by phone rather than email.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1583/001/'
    - 'https://health-isac.org/urgent-threat-alert-shinyhunters-vishing-campaigns-and-domain-impersonation/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.resource_development'
    - 'attack.t1583.001'
    - 'attack.initial_access'
    - 'attack.t1566.004'
    - 'tlp.clear'
logsource:
    category: 'dns'
detection:
    selection_claims_tld:
        query|endswith: '.claims'
    selection_claims_com:
        query|contains:
            - '-claims.com'
            - 'claims-'
    condition: 'selection_claims_tld or selection_claims_com'
falsepositives:
    - 'Legitimate registrants in the .claims TLD, including insurers and claims administrators who own their own brand under it and organizations that defensively registered their name after the August 2026 advisories. Allowlist your own and known-partner .claims names before promoting past experimental.'
    - 'Legitimate insurance, warranty, and claims-processing services that operate under <brand>-claims.com or claims-<brand>.com names. This is the noisy half of the rule; scope selection_claims_com to unresolved or newly observed domains, or drop it and keep only the .claims TLD selection in mail-heavy environments.'
    - 'Threat-intelligence, brand-protection, and security tooling that resolves lookalike domains as part of monitoring. Exclude the resolving hosts.'
level: 'medium'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1583-001-claims-registration-conjunction.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.