LegionLoader/Phishing gasparinutrition.com DNS or Network Contact from Mail Client

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule detects endpoint DNS queries or network connections to the suspected phishing domain 'gasparinutrition.com' initiated by common web browsers or email clients. This provides visibility into potential user interaction with malicious sites that would otherwise be missed by email security gateways.