Sublime-Message-body Event ID 7000003

Sublime MQL (109)

• Advance Fee Fraud (AFF) from freemail provider or suspicious TLD severity medium
• Anthropic Magic String in HTML severity low
• Attachment: Adobe image lure in body or attachment with suspicious link severity medium
• Attachment: Callback phishing solicitation via pdf file severity high
• Attachment: EML file contains HTML attachment with login portal indicators severity high
• Attachment: EML file with HTML attachment (unsolicited) severity medium
• Attachment: EML with link to credential phishing page severity high
• Attachment: EML with Sharepoint link likely unrelated to sender severity medium
• Attachment: EML with suspicious indicators severity medium
• Attachment: Fake attachment image lure severity medium
• BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
• BEC/Fraud: Student loan callback phishing severity medium
• Body HTML: Comment with 24-character hex token severity low
• Body: Embedded email headers indicative of thread hijacking/abuse severity medium
• Body: HTML whitespace stuffing with short initial message severity medium
• Body: Yellow highlighted text markers severity low
• Brand impersonation: Adobe Sign with suspicious indicators severity high
• Brand impersonation: Capital One severity high
• Brand impersonation: Cloud services with credential theft intent severity medium
• Brand impersonation: DocuSign severity high
• Brand impersonation: Evite severity medium
• Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains severity medium
• Brand impersonation: Fake Fax severity medium
• Brand impersonation: File sharing notification with template artifacts severity low
• Brand impersonation: Google Drive fake file share severity medium
• Brand impersonation: Google using Microsoft Forms severity high
• Brand impersonation: Google Workspace alert notification severity medium
• Brand impersonation: Greenvelope severity medium
• Brand impersonation: Mailgun severity medium
• Brand impersonation: Microsoft (QR code) severity high
• Brand impersonation: Microsoft logo in HTML with fake quarantine release notification severity high
• Brand impersonation: Microsoft Teams invitation severity high
• Brand impersonation: Microsoft with low reputation links severity medium
• Brand impersonation: Paperless Post severity high
• Brand impersonation: Punchbowl severity medium
• Brand impersonation: QuickBooks notification from Intuit themed company name severity medium
• Brand impersonation: Robinhood severity medium
• Brand impersonation: Sharepoint severity high
• Brand impersonation: Sharepoint fake file share severity medium
• Brand impersonation: UK government Home Office severity high
• Brand impersonation: UPS severity low
• Brand impersonation: USPS severity high
• Brand impersonation: Wells Fargo severity high
• Brand impersonation: Zoom severity medium
• Callback phishing in body or attachment (untrusted sender) severity medium
• Callback phishing via Intuit service abuse severity medium
• Callback phishing via Zelle Service Abuse severity medium
• Callback phishing: AOL senders with suspicious HTML template or PDF attachment severity high
• Callback phishing: SumUp infrastructure abuse severity high
• Canva infrastructure abuse severity medium
• Credential phishing link (unknown sender) severity high
• Credential phishing: Engaging language with IPFS link severity high
• Credential phishing: Fake password expiration from new and unsolicited sender severity medium
• Credential phishing: Financial lure via ActiveCampaign infrastructure severity medium
• Credential phishing: Suspicious e-sign agreement document notification severity medium
• Credential Phishing: W-2 lure with inline SVG Windows logo severity high
• Credential theft: Gophish abuse with hidden tracking image severity high
• CVE-2023-5631 - Roundcube Webmail XSS via crafted SVG severity critical
• Deceptive Dropbox mention severity medium
• EML attachment with credential theft language (unknown sender) severity high
• Extortion / sextortion (untrusted sender) severity low
• Fake message thread - Untrusted sender with a mismatched freemail reply-to address severity medium
• Fake shipping notification with link to free file hosting severity low
• Fake thread with suspicious indicators severity medium
• Fake voicemail notification (untrusted sender) severity medium
• Fake Zoho Sign template abuse severity medium
• Google share notification with suspicious comments severity high
• HTML content with print styling and credential theft language severity high
• HTML smuggling with atob in message body severity high
• Image as content with a link to an open redirect severity high
• Impersonation: Chrome Web Store policy severity low
• Impersonation: Fake Gmail attachment severity high
• Impersonation: SharePoint reply header anomaly severity medium
• Inline image as message with attachment or link severity low
• Link: Adobe share with suspicious indicators severity high
• Link: Credential harvesting with excess padding evasion severity high
• Link: Microsoft impersonation using hosted png with suspicious link severity medium
• Link: Self-sender with sender org in subject and credential theft indicator severity high
• Link: Suspicious SharePoint document name severity low
• Link: Zoho form link from unsolicited sender severity medium
• Microsoft device code phishing severity medium
• Open redirect (go2.aspx) leading to Microsoft credential phishing severity medium
• Open Redirect: Google domain with /url path and suspicious indicators severity medium
• Outlook hyperlink bypass: left-to-right mark (LRM) in base HTML tag severity medium
• PayPal invoice abuse severity medium
• QR Code with suspicious indicators severity high
• Reconnaissance: All recipients cc/bcc'd or undisclosed severity low
• Reconnaissance: Empty message from uncommon sender severity low
• Self-sent fake PDF attachment with misleading link severity low
• Service abuse: Google classroom solicitation severity medium
• Service abuse: Google Firebase sender address with suspicious content severity low
• Service abuse: HelloSign from an unsolicited sender address severity low
• Service Abuse: HelloSign share with suspicious sender or document name severity medium
• Service abuse: HungerRush domain with SendGrid tracking targeting ProtonMail severity high
• Service abuse: Payoneer callback scam severity medium
• Service abuse: QuickBooks notification with suspicious comments severity medium
• Sharepoint link likely unrelated to sender severity medium
• Spam/fraud: Predatory journal/research paper request severity medium
• Spam: Attendee list solicitation severity low
• Spam: Campaign with excessive space/char obfuscation and free file hosted link severity low
• Spam: Fake photo share severity low
• Spam: Item giveaway spam template severity low
• Spam: Unsolicited WordPress account creation or password reset request severity low
• Spam: Website errors solicitation severity low
• Suspicious invoice reference with missing or image-only attachments severity high
• Unicode QR code severity medium
• Venmo payment request abuse severity medium
• VIP impersonation with charitable donation fraud severity high
• VIP impersonation: Fake thread with display name match, email mismatch severity medium