Suspicious Proxy Requests to IPFS URLs Containing Email Address
Alerts when proxy request URIs target IPFS and include an email address.
- Category
- proxy
- Author
- Gavin Knapp (SigmaHQ), DRL 1.1
- Published
- 2023-03-16
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags proxy traffic where the requested URI includes an IPFS domain (ipfs.io) and also contains a user email address pattern. Attackers can use IPFS-hosted content to distribute phishing or credential-harvesting pages, making email-address-in-URI behavior a useful indicator. Detection relies on proxy logs with the requested URI field (cs-uri) matching the specified IPFS and email regex.
Reporting behind it
- blog.talosintelligence.comhttps://blog.talosintelligence.com/ipfs-abuse/
- github.comhttps://github.com/Cisco-Talos/IOCs/tree/80caca039988252fbb3f27a2e89c2f2917f582e0/2022/11
- isc.sans.eduhttps://isc.sans.edu/diary/IPFS%20phishing%20and%20the%20need%20for%20correctly%20set%20HTTP%20security%20headers/29638
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Suspicious Proxy Requests to IPFS URLs Containing Email Address
id: 5a187dce-d70f-47b4-bdc0-87dab9051abd
status: test
description: This rule flags proxy traffic where the requested URI includes an IPFS domain (ipfs.io) and also contains a user email address pattern. Attackers can use IPFS-hosted content to distribute phishing or credential-harvesting pages, making email-address-in-URI behavior a useful indicator. Detection relies on proxy logs with the requested URI field (cs-uri) matching the specified IPFS and email regex.
references:
- https://blog.talosintelligence.com/ipfs-abuse/
- https://github.com/Cisco-Talos/IOCs/tree/80caca039988252fbb3f27a2e89c2f2917f582e0/2022/11
- https://isc.sans.edu/diary/IPFS%20phishing%20and%20the%20need%20for%20correctly%20set%20HTTP%20security%20headers/29638
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml
author: Gavin Knapp, Huntrule Team
date: 2023-03-16
tags:
- attack.collection
- attack.credential-access
- attack.t1056
logsource:
category: proxy
detection:
selection:
cs-uri|re: (?i)(ipfs\.io/|ipfs\.io\s).+\..+@.+\.[a-z]+
condition: selection
falsepositives:
- Legitimate use of IPFS being used in the organisation. However the cs-uri regex looking for a user email will likely negate this.
level: low
license: DRL-1.1
related:
- id: eb6c2004-1cef-427f-8885-9042974e5eb6
type: derived