Sublime-Message-body Event ID 7000005

Sublime MQL (420)

• Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure severity high
• Advance Fee Fraud (AFF) from freemail provider or suspicious TLD severity medium
• Attachment: Adobe image lure in body or attachment with suspicious link severity medium
• Attachment: Callback phishing solicitation via text-based file severity medium
• Attachment: Dropbox image lure with no Dropbox domains in links severity medium
• Attachment: Fake secure message and suspicious indicators severity medium
• Attachment: Microsoft 365 credential phishing severity high
• Attachment: PDF bid/proposal lure with credential theft indicators severity medium
• BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
• BEC/Fraud: Romance scam severity medium
• BEC/Fraud: Scam lure with freemail pivot severity low
• Brand impersonation: Adobe Sign with suspicious indicators severity high
• Brand impersonation: Adobe with suspicious language and link severity high
• Brand impersonation: AliExpress severity medium
• Brand impersonation: Aramco severity medium
• Brand impersonation: Blockchain.com severity medium
• Brand impersonation: Booking.com severity medium
• Brand impersonation: Capital One severity high
• Brand impersonation: Chase bank with credential phishing indicators severity medium
• Brand impersonation: Cloud services with credential theft intent severity medium
• Brand impersonation: Coinbase with suspicious links severity medium
• Brand impersonation: DocuSign severity high
• Brand impersonation: DocuSign branded attachment lure with no DocuSign links severity high
• Brand impersonation: DoorDash severity medium
• Brand impersonation: Dropbox severity medium
• Brand impersonation: Enbridge severity medium
• Brand impersonation: Evite severity medium
• Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains severity medium
• Brand impersonation: Fake Fax severity medium
• Brand Impersonation: Gemini Trust Company severity medium
• Brand impersonation: Google Careers severity high
• Brand impersonation: Google Drive fake file share severity medium
• Brand impersonation: Google fake sign-in warning severity high
• Brand impersonation: Google using Microsoft Forms severity high
• Brand impersonation: Google Workspace alert notification severity medium
• Brand impersonation: Greenvelope severity medium
• Brand impersonation: LastPass severity high
• Brand impersonation: Meta and subsidiaries severity medium
• Brand impersonation: Microsoft severity high
• Brand impersonation: Microsoft logo or suspicious language with open redirect severity high
• Brand impersonation: Microsoft Planner with suspicious link severity medium
• Brand impersonation: Microsoft Teams invitation severity high
• Brand impersonation: Microsoft with embedded logo and credential theft language severity high
• Brand impersonation: Microsoft with low reputation links severity medium
• Brand impersonation: Paperless Post severity high
• Brand impersonation: Proofpoint secure messaging without legitimate indicators severity high
• Brand impersonation: Purdue ePlanroom with suspicious links severity medium
• Brand impersonation: Quickbooks severity medium
• Brand impersonation: Robinhood severity medium
• Brand impersonation: SendGrid severity medium
• Brand impersonation: Sharepoint severity high
• Brand impersonation: Sharepoint fake file share severity medium
• Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
• Brand Impersonation: Shein severity medium
• Brand impersonation: Social Security Administration severity medium
• Brand impersonation: Stripe notification severity medium
• Brand impersonation: TurboTax severity low
• Brand impersonation: Twitter severity medium
• Brand impersonation: UK government Home Office severity high
• Brand impersonation: ukr[.]net severity medium
• Brand impersonation: USPS severity high
• Brand impersonation: WeTransfer severity high
• Brand impersonation: Wise severity high
• Brand impersonation: Zoom severity medium
• Callback phishing via Google Meet severity medium
• Canva design with suspicious embedded link severity high
• Catbox.moe link from untrusted source severity medium
• ClickFunnels link infrastructure abuse severity high
• Commonly abused sender TLD with engaging language severity medium
• Constant Contact link infrastructure abuse severity high
• Credential phishing content and link (untrusted sender) severity high
• Credential phishing language and suspicious indicators (unknown sender) severity medium
• Credential phishing: 'Secure message' and engaging language severity medium
• Credential phishing: AWS Lambda URL with recipient targeting severity medium
• Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
• Credential phishing: Email delivery failure impersonation severity high
• Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
• Credential phishing: Fake card notification with tracking lure severity medium
• Credential phishing: Fake password expiration from new and unsolicited sender severity medium
• Credential phishing: Fake storage alerts (unsolicited) severity medium
• Credential phishing: Generic document share template severity low
• Credential phishing: Generic document sharing severity medium
• Credential phishing: Hyper-linked image leading to free file host severity medium
• Credential phishing: Onedrive impersonation severity high
• Credential phishing: Re-Authentication lure severity high
• Credential phishing: Suspicious e-sign agreement document notification severity medium
• Credential Phishing: Suspicious language, link, recipients and other indicators severity medium
• Credential phishing: Suspicious subject with urgent financial request and link severity medium
• Credential phishing: Tax form impersonation with payment request severity medium
• Deceptive Dropbox mention severity medium
• Display name and subject impersonation using recipient SLD (new sender) severity medium
• Display name impersonation using recipient SLD severity medium
• DocuSign impersonation via CloudHQ links severity medium
• Extortion / sextortion (untrusted sender) severity low
• Extortion / sextortion in attachment from untrusted sender severity low
• Fake email quarantine notification severity high
• Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
• Fake request for tax preparation severity high
• Fake scan-to-email message severity medium
• Fake shipping notification with link to free file hosting severity low
• Fake thread with suspicious indicators severity medium
• Fake voicemail notification (untrusted sender) severity medium
• Fake Zoho Sign template abuse severity medium
• Fake Zoom meeting invite with suspicious link severity medium
• File sharing link from suspicious sender domain severity medium
• File sharing link with a suspicious subject severity medium
• Free subdomain link with credential theft indicators severity high
• Free subdomain link with login or captcha (untrusted sender) severity medium
• Google Accelerated Mobile Pages (AMP) abuse severity medium
• Google Drive abuse: Credential phishing link severity high
• Google Drive direct download link from unsolicited sender severity medium
• Google Notification alert link from non-Google sender severity medium
• Google presentation open redirect phishing severity medium
• Google services using g.co shortlinks severity medium
• Image as content with a link to an open redirect severity high
• Impersonation: Chrome Web Store policy severity low
• Impersonation: Fake Gmail attachment severity high
• Impersonation: Human Resources with link or attachment and engaging language severity medium
• Impersonation: Internal corporate services severity high
• Impersonation: Salesforce fake campaign failure notification severity medium
• Impersonation: Suspected supplier impersonation with suspicious content severity high
• Inline image as message with attachment or link severity low
• Invoicera infrastructure abuse severity medium
• Issuu document with suspicious embedded link severity high
• Link to a domain with punycode characters severity medium
• Link to auto-download of a suspicious file type (unsolicited) severity medium
• Link to auto-downloaded file with Google Drive branding severity high
• Link to Google Apps Script macro (unsolicited) severity medium
• Link to Google Apps Script macro via comment tagging severity medium
• Link: .onion From Unsolicited Sender severity low
• Link: 9WOLF phishkit initial landing URI severity high
• Link: Abused Adobe Express severity high
• Link: Adobe share from unsolicited sender severity medium
• Link: Adobe share with suspicious indicators severity high
• Link: Apple TestFlight from suspicious sender severity medium
• Link: Base64 encoded recipient address in URL fragment with hex subdomain severity high
• Link: Base64 encoded recipient address in URL fragment with subject hash severity low
• Link: Blogspot hosting explicit romance content severity medium
• Link: Breely link masquerading as PDF severity high
• Link: chatbot.page platform abuse severity medium
• Link: Common hidden directory observed severity medium
• Link: Commonly Abused Web Service redirecting to ZIP file severity medium
• Link: Credential phishing via WordPress severity high
• Link: Cryptocurrency fraud with suspicious links severity high
• Link: CVE-2024-21413 Microsoft Outlook Remote Code Execution Vulnerability severity critical
• Link: Direct link to gamma.app document with mode parameter severity medium
• Link: Direct link to keap.app contact-us page severity medium
• Link: Direct link to limewire hosted file severity high
• Link: Direct link to riddle.com hosted showcase severity medium
• Link: Direct link to Zoom Docs from non-Zoom sender severity medium
• Link: Direct POWR.io Form Builder with suspicious patterns severity medium
• Link: Display text matches subject line severity medium
• Link: Executable file download with suspicious message content severity high
• Link: Figma design deck with credential theft language severity medium
• Link: File sharing impersonation with suspicious language and sending patterns severity medium
• Link: File sharing pretext with suspicious body and link severity medium
• Link: Financial account issue with suspicious indicators severity medium
• Link: Flagged bit.ly link severity medium
• Link: Flare-branded credential harvesting via Cloudflare tunnels severity high
• Link: Free subdomain host with undisclosed recipients severity medium
• Link: Google Calendar invite linking to an open redirect from an untrusted freemail sender severity high
• Link: Google Cloud Storage impersonating with googledrive in URL path severity high
• Link: Google Cloud Storage with suspicious URL pattern severity high
• Link: Google Firebase dynamic link that redirects to new domain (<7 days old) severity low
• Link: Google Translate (unsolicited) severity low
• Link: GoPhish query param values severity low
• Link: Hotel booking spoofed display URL severity medium
• Link: HR impersonation with suspicious domain indicators and credential theft severity high
• Link: HTML file with suspicious binary fragment ending pattern severity high
• Link: Intuit link abuse with file share context severity medium
• Link: Invoice or receipt from freemail sender with customer service number severity low
• Link: IPFS severity medium
• Link: IPv4-mapped IPv6 address obfuscation severity medium
• Link: Jensi file preview link from unsolicited sender severity medium
• Link: Job recruitment lure from unsolicited sender with suspicious hosting severity medium
• Link: Landing page with search-ms protocol redirect severity high
• Link: Microsoft Dynamics 365 form phishing severity high
• Link: Microsoft impersonation using hosted png with suspicious link severity medium
• Link: Microsoft protected message with matching sender and recipient addresses severity medium
• Link: Mixed case HTTPS protocol severity medium
• Link: Multistage landing - Abused Adobe Acrobat hosted PDF severity medium
• Link: Multistage landing - Abused Adobe frame.io severity high
• Link: Multistage Landing - Abused Buildin.ai severity medium
• Link: Multistage landing - Abused Docusign severity high
• Link: Multistage landing - Abused Google Drive severity high
• Link: Multistage landing - FreshDesk knowledge base abuse severity high
• Link: Multistage landing - JotForm abuse severity high
• Link: Multistage landing - Ludus presentation severity medium
• Link: Multistage landing - Microsoft Forms abuse severity high
• Link: Multistage landing - Published Google Doc severity high
• Link: Multistage landing - Scribd document severity medium
• Link: Multistage landing - Trello board abuse severity high
• Link: MyActiveCampaign Link Abuse severity medium
• Link: Non-standard port 8443 in display URL severity medium
• Link: Numeric IP obfuscation in URL severity medium
• Link: Obfuscation via userinfo with excessive URL padding severity medium
• Link: Obfuscation via userinfo with suspicious indicators severity low
• Link: PDF and financial display text to free file host severity high
• Link: Personal SharePoint with invalid recipients and credential theft language severity medium
• Link: Personalized URL with recipient address on commonly abused web service severity medium
• Link: QuickBooks image lure with suspicious link severity medium
• Link: Recipient domain in URL path severity high
• Link: Recipient email address in 'eta' parameter severity high
• Link: Referrer anonymization service from untrusted sender severity medium
• Link: Remittance payment request with timeline template severity medium
• Link: Romance/Sexual Language With Suspicious Link severity low
• Link: ScreenConnect installer with suspicious relay domain severity high
• Link: Scribd fullscreen link from suspicious sender severity medium
• Link: Secure SharePoint file share from new or unusual sender severity low
• Link: SharePoint files shared from GoDaddy federated tenants severity low
• Link: Spam website with evasion indicators severity low
• Link: Squarespace infrastructure abuse severity medium
• Link: Suspicious Family fragment parameter with encoded recipient data severity high
• Link: Suspicious file retrieval with recipient targeting severity high
• Link: Suspicious SharePoint document name severity low
• Link: Suspicious Sharepoint folder share severity high
• Link: Suspicious URL path with binary character sequence severity medium
• Link: Suspicious URL with recipient targeting and special characters severity high
• Link: SVG with embedded recipient data severity high
• Link: Tax document lure Portuguese/Spanish with suspicious domains severity medium
• Link: Uncommon SharePoint document type with sender's display name severity medium
• Link: Unsolicited email contains link to page containing Tycoon URI structure severity high
• Link: URL fragment with hexadecimal pattern obfuscation severity high
• Link: Webflow link from unsolicited sender severity medium
• Link: WordPress admin targeting with recipient identifier in URL fragment severity high
• Link: WordPress login page with Blogspot Binance scam severity medium
• Link: Zoho form link from unsolicited sender severity medium
• Low reputation link to auto-downloaded HTML file with smuggling indicators severity high
• Malformed URL prefix severity high
• Malware: Pikabot delivery via URL auto-download severity high
• Mass campaign: Cross Site Scripting (XSS) attempt severity medium
• Mass campaign: recipient address in subject, body, and link (untrusted sender) severity medium
• Microsoft device code phishing severity medium
• Mismatched links: Free file share with urgent language severity medium
• New link domain (<=10d) from untrusted sender severity medium
• Newly registered sender or reply-to domain with newly registered linked domain severity medium
• Notion suspicious file share severity medium
• Open redirect (go2.aspx) leading to Microsoft credential phishing severity medium
• Open redirect: adnxs.com severity medium
• Open redirect: agena-smile.com severity medium
• Open redirect: amaterasu-for-website-5.com severity medium
• Open redirect: api.spently.com severity medium
• Open redirect: Artisteer severity medium
• Open redirect: artkaderne severity medium
• Open Redirect: asemailmgmteu.com severity medium
• Open redirect: astroarts.co.jp severity medium
• Open redirect: Atdmt severity medium
• Open redirect: Avast severity medium
• Open redirect: bananaguide.com severity medium
• Open redirect: bangkoksync.com severity medium
• Open redirect: bestdeals.today severity medium
• Open redirect: Bitrix24 URL Path severity medium
• Open redirect: BMW USA severity medium
• Open redirect: bubblelife.com severity medium
• Open redirect: buildingengines.com severity medium
• Open redirect: business.google.com website_shared URL Param severity medium
• Open redirect: Cartoon Network severity medium
• Open redirect: chkc.com.hk severity medium
• Open redirect: City of Calgary severity medium
• Open redirect: Club-OS severity medium
• Open redirect: convertcart.com severity medium
• Open redirect: Dell severity medium
• Open redirect: designsori.com severity medium
• Open redirect: documentmailbox.com severity medium
• Open redirect: Doubleclick.net severity medium
• Open redirect: eaoko.org severity medium
• Open redirect: easycamp.com severity medium
• Open redirect: embluemail.com severity medium
• Open redirect: emlakarsa severity medium
• Open redirect: emp.eduyield.com severity medium
• Open redirect: eodcnetworkdirect.com severity medium
• Open redirect: events.csiro.au severity medium
• Open redirect: ExacTag severity medium
• Open redirect: fenc.com severity medium
• Open redirect: g7.fr severity medium
• Open redirect: giving.lluh.org severity medium
• Open redirect: Google Ad Services severity medium
• Open Redirect: Google domain with /url path and suspicious indicators severity medium
• Open redirect: Google Web Light severity medium
• Open redirect: Hakumonkai.org severity high
• Open redirect: HHS severity medium
• Open redirect: ijf.org severity medium
• Open redirect: Indeed severity medium
• Open redirect: IndiaTimes severity medium
• Open redirect: isadatalab.com severity medium
• Open redirect: k-mil.net severity medium
• Open redirect: Klaviyo severity medium
• Open redirect: labcluster.com severity medium
• Open redirect: LearningApps severity medium
• Open redirect: Linkedin severity medium
• Open redirect: LinkedIn Redirect severity medium
• Open redirect: listing.ca severity medium
• Open redirect: magic4media.com severity medium
• Open redirect: magiccity.ne.jp severity medium
• Open redirect: magneticmarketing.com severity medium
• Open redirect: mail.spiceworks.com severity medium
• Open redirect: Mailtrack Korea severity medium
• Open redirect: marketing.edinburghairport.com severity medium
• Open redirect: McGill University severity low
• Open redirect: Medium severity medium
• Open redirect: Meta --> YouTube Redirection Chain severity medium
• Open redirect: mindmixer.com severity medium
• Open redirect: MSN severity medium
• Open redirect: museepicassoparis.fr severity medium
• Open redirect: Nested Doubleclick.net severity high
• Open redirect: Newegg severity medium
• Open redirect: next2.io severity medium
• Open redirect: nowlifestyle.com severity medium
• Open redirect: obunsha.co.jp severity medium
• Open redirect: Panera Bread severity medium
• Open redirect: people.anuneo.com severity medium
• Open redirect: phoenixartstudio.net severity medium
• Open redirect: PIRL San Diego severity medium
• Open redirect: plasticsurgery.or.kr severity medium
• Open redirect: pmifunds.com severity medium
• Open redirect: predictiveresponse.net severity medium
• Open redirect: PremierBet severity medium
• Open redirect: qrxtech.com severity medium
• Open redirect: queue.swytchbike.com severity medium
• Open redirect: radiopublic.com severity medium
• Open redirect: retailrocket.net severity medium
• Open redirect: ringaraja.net severity medium
• Open redirect: Samsung severity medium
• Open redirect: sciencebuddies.org severity medium
• Open redirect: secondstreetapp.com severity medium
• Open redirect: Shibboleth SSO Logout Return Parameter severity high
• Open redirect: shoppermeet.net severity medium
• Open redirect: shoppingwebapi.didatravel.com severity medium
• Open redirect: Signature Travel Network severity medium
• Open redirect: Slack severity low
• Open redirect: slubnaglowie.pl severity medium
• Open redirect: smartadserver.com severity medium
• Open redirect: smore.com severity medium
• Open redirect: Snapchat severity medium
• Open redirect: social.bigpress.net severity medium
• Open redirect: ssg-financial.com severity medium
• Open redirect: stats.lib.pdx.edu severity medium
• Open redirect: storematch.jp severity medium
• Open redirect: Ticketmaster severity low
• Open redirect: TikTok severity medium
• Open redirect: tkqlhce.com severity medium
• Open redirect: tuttocauzioni.it severity medium
• Open redirect: typedrawers.com severity medium
• Open redirect: U.S. Antarctic Program Data Center (USAP-DC) severity medium
• Open redirect: unitedwaynwvt.org severity medium
• Open redirect: ust.hk severity medium
• Open redirect: vconfex.com severity medium
• Open redirect: VK severity medium
• Open redirect: weblinkconnect.com severity medium
• Open redirect: whitefox.pl severity medium
• Open redirect: Xfinity CMP Redirection to Google AMP severity medium
• Open redirect: xfinity.com severity medium
• Open redirect: YouTube severity medium
• Open redirect: YouTube --> Google Redirection Chain severity medium
• PhaaS: Impact Solutions (Impact Vector Suite) severity medium
• Reconnaissance: All recipients cc/bcc'd or undisclosed severity low
• Reconnaissance: Large unknown recipient list severity low
• Recruitee Infrastructure Abuse severity high
• Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
• Salesforce infrastructure abuse severity medium
• Service abuse: AppSheet infrastructure with suspicious indicators severity medium
• Service Abuse: Box file sharing with credential phishing intent severity medium
• Service abuse: Callback phishing via Microsoft Teams invite severity high
• Service abuse: Facebook business with action required subject severity medium
• Service abuse: FlipHTML5 with attachment deception and credential theft language severity medium
• Service abuse: Formester with suspicious link behavior severity medium
• Service abuse: GitHub notification with excessive mentions and suspicious links severity high
• Service Abuse: GoDaddy infrastructure severity medium
• Service abuse: Google account notification with links to free file host severity high
• Service abuse: Google application integration redirecting to suspicious hosts severity medium
• Service abuse: Google Firebase sender address with suspicious content severity low
• Service abuse: Google OAuth with suspicious redirect destination severity medium
• Service abuse: Google Tag Manager debug cookie clearing with open redirect potential severity high
• Service abuse: Meetup.com redirect with brand impersonation severity medium
• Service abuse: Mimecast URL with excessive path length severity high
• Service abuse: Monday.com infrastructure with phishing intent severity high
• Service abuse: Sendgrid credential theft with personalized request targeting single recipient severity medium
• Service abuse: SendGrid-formatted link with actor-controlled fragment severity high
• Service abuse: Suspicious Datadog alert severity high
• Service abuse: Suspicious Zoom Docs link severity low
• Service abuse: Wix redirect through bulk mailer domains severity low
• Sharepoint file share with suspicious recipients pattern severity medium
• Sharepoint link likely unrelated to sender severity medium
• Spam/fraud: Predatory journal/research paper request severity medium
• Spam: Attendee list solicitation severity low
• Spam: BlackBaud infrastructure abuse severity medium
• Spam: Campaign with excessive display-text and keywords found severity low
• Spam: Campaign with excessive space/char obfuscation and free file hosted link severity low
• Spam: Commonly observed formatting of unauthorized free giveaways severity low
• Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
• Spam: Fake dating profile notification severity low
• Spam: Fake photo share severity low
• Spam: Firebase password reset from suspicious sender severity low
• Spam: Link to blob.core.windows.net from new domain (<30d) severity medium
• Spam: New job cold outreach from unsolicited sender severity low
• Spam: New link domain (<=10d) and emojis severity medium
• Spam: Single recipient duplicated in cc severity medium
• Spam: Unsolicited malformed PDF severity low
• Spam: Unsolicited WordPress account creation or password reset request severity low
• Spam: URL shortener with short body content and emojis severity low
• Spam: Website errors solicitation severity low
• Spoofable internal domain with suspicious signals severity medium
• Suspected lookalike domain with suspicious language severity medium
• Suspicious invoice reference with missing or image-only attachments severity high
• Suspicious link to Looker Studio (lookerstudio.google.com) from a new and unsolicited sender severity medium
• Suspicious Links to Cloudflare R2 and Edge Services severity medium
• Suspicious message with unscannable Cloudflare link severity medium
• Suspicious message with unscannable Vercel link severity medium
• Suspicious recipient pattern and language with low reputation link to login severity medium
• Suspicious recipients pattern with NLU credential theft indicators severity medium
• Suspicious request for financial information severity high
• Suspicious SharePoint file sharing severity medium
• Tax Form: W-8BEN solicitation severity medium
• Truth Social infrastructure abuse via link redirect severity medium
• Twitter infrastructure abuse via link shortener severity medium
• URL with Unicode U+2044 (⁄) or U+2215 (∕) characters severity low
• URLhaus: Malicious domain in message body or pdf attachment (trusted reporters) severity medium
• Vendor compromise: GovDelivery message with suspicious link severity high
• Xero infrastructure abuse severity medium
• Xero invoice abuse severity medium