rule bulwark_https_bulwarkblack_com_purpledelta_remote_hiring_insider_risk_control
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/purpledelta-remote-hiring-insider-risk-control/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-19T05:28:46Z"
        tlp = "TLP:CLEAR"
        indicator_count = "58"
    strings:
        $s0 = "E-Verify.gov" ascii wide nocase  // Domains
        $s1 = "insertFace.com" ascii wide nocase  // Domains
        $s2 = "minicursor.com" ascii wide nocase  // Domains
        $s3 = "trustidcard.com" ascii wide nocase  // Domains
        $s4 = "104.129.55.3" ascii wide nocase  // IPv4
        $s5 = "104.253.1.79" ascii wide nocase  // IPv4
        $s6 = "104.253.102.119" ascii wide nocase  // IPv4
        $s7 = "104.253.103.238" ascii wide nocase  // IPv4
        $s8 = "104.253.111.106" ascii wide nocase  // IPv4
        $s9 = "104.253.112.86" ascii wide nocase  // IPv4
        $s10 = "104.253.115.202" ascii wide nocase  // IPv4
        $s11 = "104.253.115.254" ascii wide nocase  // IPv4
        $s12 = "104.253.120.177" ascii wide nocase  // IPv4
        $s13 = "104.253.120.203" ascii wide nocase  // IPv4
        $s14 = "104.253.121.146" ascii wide nocase  // IPv4
        $s15 = "104.253.134.123" ascii wide nocase  // IPv4
        $s16 = "104.253.137.28" ascii wide nocase  // IPv4
        $s17 = "104.253.14.73" ascii wide nocase  // IPv4
        $s18 = "104.253.145.7" ascii wide nocase  // IPv4
        $s19 = "104.253.147.147" ascii wide nocase  // IPv4
        $s20 = "104.253.160.220" ascii wide nocase  // IPv4
        $s21 = "104.253.164.246" ascii wide nocase  // IPv4
        $s22 = "104.253.17.141" ascii wide nocase  // IPv4
        $s23 = "104.253.173.139" ascii wide nocase  // IPv4
        $s24 = "104.253.177.189" ascii wide nocase  // IPv4
        $s25 = "104.253.19.244" ascii wide nocase  // IPv4
        $s26 = "104.253.199.214" ascii wide nocase  // IPv4
        $s27 = "104.253.20.50" ascii wide nocase  // IPv4
        $s28 = "104.253.207.214" ascii wide nocase  // IPv4
        $s29 = "104.253.221.132" ascii wide nocase  // IPv4
        $s30 = "104.253.224.179" ascii wide nocase  // IPv4
        $s31 = "104.253.224.93" ascii wide nocase  // IPv4
        $s32 = "104.253.226.188" ascii wide nocase  // IPv4
        $s33 = "104.253.229.199" ascii wide nocase  // IPv4
        $s34 = "104.253.229.208" ascii wide nocase  // IPv4
        $s35 = "104.253.243.171" ascii wide nocase  // IPv4
        $s36 = "104.253.245.40" ascii wide nocase  // IPv4
        $s37 = "104.253.251.19" ascii wide nocase  // IPv4
        $s38 = "104.253.254.82" ascii wide nocase  // IPv4
        $s39 = "104.253.34.67" ascii wide nocase  // IPv4
        $s40 = "104.253.44.236" ascii wide nocase  // IPv4
        $s41 = "104.253.45.193" ascii wide nocase  // IPv4
        $s42 = "104.253.46.118" ascii wide nocase  // IPv4
        $s43 = "104.253.47.239" ascii wide nocase  // IPv4
        $s44 = "104.253.51.76" ascii wide nocase  // IPv4
        $s45 = "104.253.52.123" ascii wide nocase  // IPv4
        $s46 = "104.253.56.226" ascii wide nocase  // IPv4
        $s47 = "104.253.7.202" ascii wide nocase  // IPv4
        $s48 = "104.253.72.75" ascii wide nocase  // IPv4
        $s49 = "104.253.90.150" ascii wide nocase  // IPv4
        $s50 = "155.94.198.2" ascii wide nocase  // IPv4
        $s51 = "167.88.61.117" ascii wide nocase  // IPv4
        $s52 = "167.88.61.250" ascii wide nocase  // IPv4
        $s53 = "189.1.170.50" ascii wide nocase  // IPv4
        $s54 = "192.161.60.140" ascii wide nocase  // IPv4
        $s55 = "204.188.232.195" ascii wide nocase  // IPv4
        $s56 = "218.24.120.118" ascii wide nocase  // IPv4
        $s57 = "23.106.169.120" ascii wide nocase  // IPv4
    condition:
        any of ($s*)
}