lorentz/wulf-pulse
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

feat(quick-260717-a19): add 3 confirmed KnowBe4 domains to sim allowlist

Browse source 
- Extend knowbe4 vendor entry with customer-portal.info,
  cloud-service-care.com, bankonlinesupport.com (confirmed via shared
  URL fingerprint across Seubert tickets 699419/699421/699422/699433/
  699435/699456 on 2026-07-16/17)
- domainMatchesAllowlist and isKnownSimulationSender untouched
- Add tests for exact match, subdomain match, and suffix-spoof rejection
This commit is contained in:
lorentz 2026-07-17 07:19:18 -04:00
parent 075c4bbd24
commit 204276c88a
2 changed files with 25 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
lib/services/campaign-classifier.test.ts
View file

@ -60,6 +60,20 @@ describe('domainMatchesAllowlist', () => {
expect(domainMatchesAllowlist('it-support.care.attacker.net')).toBe(false);
expect(domainMatchesAllowlist('evil-it-support.care')).toBe(false);
});
it('matches the 3 KnowBe4 domains confirmed via Seubert ticket 699456 (260717-a19)', () => {
expect(domainMatchesAllowlist('customer-portal.info')).toBe(true);
expect(domainMatchesAllowlist('cloud-service-care.com')).toBe(true);
expect(domainMatchesAllowlist('bankonlinesupport.com')).toBe(true);
});
it('matches a subdomain of the newly-added customer-portal.info', () => {
expect(domainMatchesAllowlist('mail.customer-portal.info')).toBe(true);
});
it('does NOT match a suffix-spoofed variant of the newly-added domain', () => {
expect(domainMatchesAllowlist('customer-portal.info.attacker.net')).toBe(false);
});
});
describe('isKnownSimulationSender', () => {

13
lib/services/campaign-classifier.ts
View file

@ -33,8 +33,17 @@ import { getBlastRadius, type BlastRadiusResult } from './mimecast-blast-radius'
export const KNOWN_SIMULATION_SENDERS: readonly { vendor: string; domains: readonly string[] }[] = [
{
vendor: 'knowbe4',
// 219 tickets, ~37 impersonated personas — 19-RESEARCH.md D-07 finding #2
domains: ['it-support.care'],
// 219 tickets, ~37 impersonated personas — 19-RESEARCH.md D-07 finding #2.
// customer-portal.info, cloud-service-care.com, bankonlinesupport.com
// confirmed via shared /render-template/ + /tracking/ URL fingerprint
// across Seubert tickets 699419/699421/699422/699433/699435/699456 on
// 2026-07-16/17 (quick task 260717-a19).
domains: [
'it-support.care',
'customer-portal.info',
'cloud-service-care.com',
'bankonlinesupport.com',
],
},
{
vendor: 'breach-secure-now',