T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain

DNS resolution of a domain matching the ShinyHunters "The Com" claims-impersonation campaign naming grammar — a victim brand rendered as <brand>.claims, <brand>-claims.com, claims-<brand>.com, or us-<brand>.com. The campaign registers these through Dynadot, fronts them with Cloudflare, and provisions a same-day Google Trust Services certificate with no MX record; the network-observable tail of that acquired infrastructure is a client resolving the name. The .claims TLD is a small Identity Digital namespace dominated by abuse (per Flare, roughly a third of first-half-August registrations belonged to this one operator), so a query into it warrants review against an allowlist of the organization's own legitimately registered names. The -claims.com and claims- constructions are noisier because legitimate insurance and claims-processing domains use them, so they are scoped and should be tuned per environment. This rule is the resolver-layer complement to the certificate-transparency watch described in the research; blocking the name is cheap before a page is served and is the one control point a defender holds outright when delivery is by phone rather than email.

Intel context

The techniques this rule covers are quiet in the corpus this week — no current KEV, OSINT, or active-family signal. The detection stands ready; there is simply nothing exercising it right now. (Checked September 18, 2026.)

Rule ID: 0623d53d-7bf8-4412-bc11-9f3cdda81b2d
Status: experimental
Level: medium
Log source: category: dns
Date: 2026-09-12
Modified: 2026-09-12
ATT&CK: T1566.004 , T1583.001 (signal rollup)
Canonical YAML: t1583-001-claims-registration-conjunction.yml

References

False positives

Legitimate registrants in the .claims TLD, including insurers and claims administrators who own their own brand under it and organizations that defensively registered their name after the August 2026 advisories. Allowlist your own and known-partner .claims names before promoting past experimental.
Legitimate insurance, warranty, and claims-processing services that operate under <brand>-claims.com or claims-<brand>.com names. This is the noisy half of the rule; scope selection_claims_com to unresolved or newly observed domains, or drop it and keep only the .claims TLD selection in mail-heavy environments.
Threat-intelligence, brand-protection, and security tooling that resolves lookalike domains as part of monitoring. Exclude the resolving hosts.

Rule YAML

title: 'T1583.001 Resolution of a ShinyHunters .claims Impersonation Domain'
id: '0623d53d-7bf8-4412-bc11-9f3cdda81b2d'
status: 'experimental'
description: 'DNS resolution of a domain matching the ShinyHunters "The Com" claims-impersonation campaign naming grammar — a victim brand rendered as <brand>.claims, <brand>-claims.com, claims-<brand>.com, or us-<brand>.com. The campaign registers these through Dynadot, fronts them with Cloudflare, and provisions a same-day Google Trust Services certificate with no MX record; the network-observable tail of that acquired infrastructure is a client resolving the name. The .claims TLD is a small Identity Digital namespace dominated by abuse (per Flare, roughly a third of first-half-August registrations belonged to this one operator), so a query into it warrants review against an allowlist of the organization''s own legitimately registered names. The -claims.com and claims- constructions are noisier because legitimate insurance and claims-processing domains use them, so they are scoped and should be tuned per environment. This rule is the resolver-layer complement to the certificate-transparency watch described in the research; blocking the name is cheap before a page is served and is the one control point a defender holds outright when delivery is by phone rather than email.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1583/001/'
    - 'https://health-isac.org/urgent-threat-alert-shinyhunters-vishing-campaigns-and-domain-impersonation/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.resource_development'
    - 'attack.t1583.001'
    - 'attack.initial_access'
    - 'attack.t1566.004'
    - 'tlp.clear'
logsource:
    category: 'dns'
detection:
    selection_claims_tld:
        query|endswith: '.claims'
    selection_claims_com:
        query|contains:
            - '-claims.com'
            - 'claims-'
    condition: 'selection_claims_tld or selection_claims_com'
falsepositives:
    - 'Legitimate registrants in the .claims TLD, including insurers and claims administrators who own their own brand under it and organizations that defensively registered their name after the August 2026 advisories. Allowlist your own and known-partner .claims names before promoting past experimental.'
    - 'Legitimate insurance, warranty, and claims-processing services that operate under <brand>-claims.com or claims-<brand>.com names. This is the noisy half of the rule; scope selection_claims_com to unresolved or newly observed domains, or drop it and keep only the .claims TLD selection in mail-heavy environments.'
    - 'Threat-intelligence, brand-protection, and security tooling that resolves lookalike domains as part of monitoring. Exclude the resolving hosts.'
level: 'medium'

The YAML file above is the canonical artifact — machine consumers should subscribe via /sigma/manifest.json and fetch t1583-001-claims-registration-conjunction.yml directly. Each rule's live intel context is in /sigma/evidence.json keyed by slug. This page is a rendered view, regenerated daily.