Sublime-Message-headers Event ID 7000008

Sublime MQL (259)

• Advance Fee Fraud (AFF) from freemail provider or suspicious TLD severity medium
• AnonymousFox indicators severity high
• Attachment with auto-executing macro (unsolicited) severity medium
• Attachment: Adobe image lure in body or attachment with suspicious link severity medium
• Attachment: Calendar invite with suspicious link leading to an open redirect severity high
• Attachment: Callback phishing solicitation via image file severity high
• Attachment: Callback phishing solicitation via pdf file severity high
• Attachment: Callback phishing solicitation via text-based file severity medium
• Attachment: DocuSign impersonation via PDF linking to new domain severity medium
• Attachment: EML file contains HTML attachment with login portal indicators severity high
• Attachment: EML file with HTML attachment (unsolicited) severity medium
• Attachment: EML with link to credential phishing page severity high
• Attachment: EML with Sharepoint link likely unrelated to sender severity medium
• Attachment: Encrypted PDF with credential theft body severity medium
• Attachment: Fake attachment image lure severity medium
• Attachment: Fake secure message and suspicious indicators severity medium
• Attachment: Legal themed message or PDF with suspicious indicators severity medium
• Attachment: Microsoft 365 credential phishing severity high
• Attachment: Microsoft impersonation via PDF with link and suspicious language severity high
• Attachment: Office document with VSTO add-in severity high
• Attachment: PDF proposal with credential theft indicators severity high
• Attachment: PDF with credential theft language and invalid reply-to domain severity medium
• Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender severity medium
• BEC with unusual reply-to or return-path mismatch severity high
• BEC/Fraud: Generic scam attempt to undisclosed recipients severity low
• BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
• BEC/Fraud: Penpal scam severity medium
• BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium
• Benefits enrollment impersonation severity high
• Body HTML: Recipient SLD in HTML class severity medium
• Body: Embedded email headers indicative of thread hijacking/abuse severity medium
• Body: HTML whitespace stuffing with short initial message severity medium
• Brand impersonation: Adobe (QR code) severity high
• Brand impersonation: Adobe Sign with suspicious indicators severity high
• Brand impersonation: Adobe with suspicious language and link severity high
• Brand impersonation: AliExpress severity medium
• Brand impersonation: Amazon severity low
• Brand impersonation: Aquent severity medium
• Brand impersonation: Aramco severity medium
• Brand impersonation: Booking.com severity medium
• Brand impersonation: Box file sharing service severity medium
• Brand impersonation: Capital One severity high
• Brand impersonation: Cloud services with credential theft intent severity medium
• Brand impersonation: DHL severity low
• Brand impersonation: DocuSign severity high
• Brand impersonation: DocuSign branded attachment lure with no DocuSign links severity high
• Brand impersonation: Dropbox severity medium
• Brand impersonation: Enbridge severity medium
• Brand impersonation: Evite severity medium
• Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains severity medium
• Brand Impersonation: Gemini Trust Company severity medium
• Brand impersonation: Github severity high
• Brand Impersonation: Google (QR Code) severity high
• Brand impersonation: Google Drive fake file share severity medium
• Brand impersonation: Google using Microsoft Forms severity high
• Brand impersonation: Google Workspace alert notification severity medium
• Brand impersonation: Greenvelope severity medium
• Brand impersonation: Internal Revenue Service severity high
• Brand impersonation: LinkedIn severity medium
• Brand impersonation: Mailchimp severity medium
• Brand impersonation: Mailgun severity medium
• Brand impersonation: Meta and subsidiaries severity medium
• Brand impersonation: Microsoft (QR code) severity high
• Brand impersonation: Microsoft fake sign-in alert severity medium
• Brand impersonation: Microsoft logo in HTML with fake quarantine release notification severity high
• Brand impersonation: Microsoft logo or suspicious language with open redirect severity high
• Brand impersonation: Microsoft Planner with suspicious link severity medium
• Brand impersonation: Microsoft Teams invitation severity high
• Brand impersonation: Microsoft with embedded logo and credential theft language severity high
• Brand impersonation: Microsoft with low reputation links severity medium
• Brand impersonation: Morgan Stanley severity medium
• Brand impersonation: Norton severity low
• Brand impersonation: Okta severity medium
• Brand impersonation: Paperless Post severity high
• Brand impersonation: PNC severity medium
• Brand Impersonation: Procore severity medium
• Brand impersonation: QuickBooks notification from Intuit themed company name severity medium
• Brand impersonation: Robert Half severity medium
• Brand impersonation: Robinhood severity medium
• Brand Impersonation: ShareFile severity medium
• Brand impersonation: Sharepoint severity high
• Brand impersonation: Sharepoint fake file share severity medium
• Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
• Brand impersonation: Social Security Administration severity medium
• Brand Impersonation: Stripe severity high
• Brand impersonation: TikTok severity medium
• Brand impersonation: Twitter severity medium
• Brand impersonation: UK government Home Office severity high
• Brand impersonation: USPS severity high
• Brand impersonation: Wix severity medium
• Brand impersonation: Zoom severity medium
• Brand spoof: Dropbox severity medium
• Business Email Compromise (BEC) attempt from unsolicited sender severity medium
• Business Email Compromise (BEC) attempt from untrusted sender severity medium
• Business Email Compromise (BEC) attempt from untrusted sender (French/Français) severity medium
• Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited) severity medium
• Business Email Compromise (BEC) with request for mobile number severity medium
• Business Email Compromise: Request for mobile number via reply thread hijacking severity medium
• Callback phishing in body or attachment (untrusted sender) severity medium
• Callback phishing solicitation in message body severity medium
• Callback phishing via e-signature service severity high
• Callback phishing via Intuit service abuse severity medium
• Callback phishing: AOL senders with suspicious HTML template or PDF attachment severity high
• Callback phishing: Branded invoice from sender/reply-to domain less than 30 days old severity medium
• ClickFunnels link infrastructure abuse severity high
• Compensation review with QR code in attached EML severity high
• Constant Contact link infrastructure abuse severity high
• COVID-19 themed fraud with sender and reply-to mismatch or compensation award severity medium
• Credential phishing content and link (untrusted sender) severity high
• Credential phishing language and suspicious indicators (unknown sender) severity medium
• Credential phishing link (unknown sender) severity high
• Credential phishing: 'Secure message' and engaging language severity medium
• Credential phishing: Blue button styled link with file-sharing template artifacts severity low
• Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
• Credential phishing: Email delivery failure impersonation severity high
• Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
• Credential phishing: Fake password expiration from new and unsolicited sender severity medium
• Credential phishing: Fake storage alerts (unsolicited) severity medium
• Credential phishing: Financial lure via ActiveCampaign infrastructure severity medium
• Credential phishing: Hyper-linked image leading to free file host severity medium
• Credential phishing: Onedrive impersonation severity high
• Credential phishing: Suspicious e-sign agreement document notification severity medium
• Credential phishing: Suspicious subject with urgent financial request and link severity medium
• Cyrillic vowel substitution in subject or display name from unknown sender severity medium
• Cyrillic vowel substitutions with suspicious subject from unknown sender severity medium
• Domain impersonation: Freemail reply-to local lookalike with financial request severity medium
• EML attachment with credential theft language (unknown sender) severity high
• Employee impersonation: Payroll fraud severity high
• Encrypted Microsoft Office files from untrusted sender severity medium
• Extortion / sextortion (untrusted sender) severity low
• Extortion / sextortion in attachment from untrusted sender severity low
• Fake email quarantine notification severity high
• Fake message thread - Untrusted sender with a mismatched freemail reply-to address severity medium
• Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
• Fake request for tax preparation severity high
• Fake thread with suspicious indicators severity medium
• Fake voicemail notification (untrusted sender) severity medium
• Fake Zoom meeting invite with suspicious link severity medium
• Fraudulent e-commerce operators severity high
• Fraudulent order confirmation/shipping notification from Chinese sender domain severity medium
• Free email provider sender with mismatched provider reply-to severity medium
• Generic service abuse from newly registered domain severity high
• Google share notification with suspicious comments severity high
• Hardbacon infrastructure abuse severity high
• Headers: Fake in-reply-to with wildcard sender and missing thread context severity high
• Headers: Invalid recipient domain with mismatched reply-to from new sender severity medium
• Headers: iOS/iPadOS mailer with invalid build number severity medium
• Headers: Outlook Express mailer severity medium
• Headers: risky-recover-production message ID severity low
• Headers: Self-sender using Microsoft CompAuth bypass with credential theft content severity high
• Headers: X-Source-Auth mismatch with mismatched reply-to domain severity high
• Headers: Zimbra mailer from a non-supported OS version severity medium
• Honorific greeting BEC attempt with sender and reply-to mismatch severity low
• HR impersonation via e-sign agreement comment severity high
• HTML smuggling containing recipient email address severity medium
• Impersonation: Employee using fabricated identity in initial contact severity high
• Impersonation: Human Resources with link or attachment and engaging language severity medium
• Impersonation: Internal corporate services severity high
• Impersonation: SharePoint reply header anomaly severity medium
• Impersonation: Suspected supplier impersonation with suspicious content severity high
• Inbound message from popular service via newly observed distribution list severity medium
• Investor solicitation with organization targeting severity medium
• Link: Apple TestFlight from suspicious sender severity medium
• Link: Credential phishing traversing Russian infrastructure severity high
• Link: Credential phishing via WordPress severity high
• Link: Executable file download with suspicious message content severity high
• Link: File sharing impersonation with suspicious language and sending patterns severity medium
• Link: Free file hosting with undisclosed recipients severity medium
• Link: Free subdomain host with undisclosed recipients severity medium
• Link: Google Calendar invite linking to an open redirect from an untrusted freemail sender severity high
• Link: Multistage landing - Abused Adobe Acrobat hosted PDF severity medium
• Link: Multistage landing - Abused Google Drive severity high
• Link: Multistage landing - Published Google Doc severity high
• Link: Non-standard port 8443 in display URL severity medium
• Link: Referrer anonymization service from untrusted sender severity medium
• Link: Romance/Sexual Language With Suspicious Link severity low
• Link: SharePoint files shared from GoDaddy federated tenants severity low
• Link: SharePoint OneNote or PDF link with self sender behavior severity medium
• Link: Squarespace infrastructure abuse severity medium
• Link: Suspicious Sharepoint folder share severity high
• Link: Uncommon SharePoint document type with sender's display name severity medium
• Mass campaign: Cross Site Scripting (XSS) attempt severity medium
• Message traversed multiple onmicrosoft.com tenants severity medium
• Microsoft infrastructure abuse with suspicious patterns severity high
• Newly registered sender or reply-to domain with newly registered linked domain severity medium
• Open redirect (go2.aspx) leading to Microsoft credential phishing severity medium
• Open redirect: bubblelife.com severity medium
• Open redirect: convertcart.com severity medium
• Open redirect: embluemail.com severity medium
• Open Redirect: Google domain with /url path and suspicious indicators severity medium
• Open redirect: magic4media.com severity medium
• Open redirect: pmifunds.com severity medium
• Open redirect: predictiveresponse.net severity medium
• Open redirect: qrxtech.com severity medium
• Open redirect: secondstreetapp.com severity medium
• Open redirect: Signature Travel Network severity medium
• Open redirect: smartadserver.com severity medium
• Open redirect: tuttocauzioni.it severity medium
• Open redirect: weblinkconnect.com severity medium
• PHP Mailer with common phishing attachments severity medium
• QR Code with suspicious indicators severity high
• Reconnaissance: Empty subject with mismatched reply-to from new sender severity medium
• Reconnaissance: Hotel booking reply-to redirect severity medium
• Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
• Salesforce infrastructure abuse severity medium
• Scam: Fake estate sale offering welding equipment and tools severity high
• Scam: Piano giveaway severity medium
• Service abuse: AppSheet infrastructure with suspicious indicators severity medium
• Service abuse: Cisco secure email service with financial request severity high
• Service abuse: DocSend share from newly registered domain severity high
• Service abuse: DocuSign notification with suspicious sender or document name severity medium
• Service abuse: DocuSign share from an unsolicited reply-to address severity medium
• Service abuse: Dropbox share from new domain severity medium
• Service abuse: Dropbox share with suspicious sender or document name severity medium
• Service Abuse: ExactTarget with suspicious sender indicators severity high
• Service abuse: Free provider with SendGrid routing severity medium
• Service abuse: GitHub notification with excessive mentions and suspicious links severity high
• Service abuse: Google Drive share from an unsolicited reply-to address severity medium
• Service abuse: Google Drive share from new reply-to domain severity medium
• Service abuse: Google Firebase sender address with suspicious content severity low
• Service abuse: HelloSign from an unsolicited sender address severity low
• Service Abuse: HelloSign share with suspicious sender or document name severity medium
• Service abuse: Monday.com infrastructure with phishing intent severity high
• Service abuse: QuickBooks notification from new domain severity medium
• Service abuse: Sendgrid credential theft with personalized request targeting single recipient severity medium
• Service abuse: SendGrid impersonation via Sendgrid from new sender severity high
• Service abuse: SendThisFile with credential theft and financial language severity medium
• Service abuse: SurveyMonkey survey from newly registered domain severity high
• Service abuse: Trello board invitation with VIP impersonation severity medium
• SharePoint OTP for filename matching org name severity medium
• Spam/fraud: Predatory journal/research paper request severity medium
• Spam: BlackBaud infrastructure abuse severity medium
• Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
• Spam: Fake dating profile notification severity low
• Spam: Fake photo share severity low
• Spam: Personalized subject and greetings via Salesforce Marketing Cloud severity low
• Spam: Sendersrv.com with financial communications and unsubscribe language severity medium
• Spam: Sexually explicit Google Drive share severity low
• Spam: Sexually explicit Looker Studio report severity low
• Spam: Single recipient duplicated in cc severity medium
• SPF temp error severity medium
• Spoofable internal domain with suspicious signals severity medium
• Suspected cross-site scripting (XSS) found in subject severity medium
• Suspicious DocuSign share from new domain severity high
• Suspicious mailer received from Gmail servers severity low
• Suspicious newly registered reply-to domain with engaging financial or urgent language severity medium
• Suspicious recipients pattern with no Compauth pass and suspicious content severity medium
• Suspicious request for financial information severity high
• Suspicious SharePoint file sharing severity medium
• Vendor compromise: GovDelivery message with suspicious link severity high
• VIP / Executive impersonation (strict match, untrusted) severity high
• VIP Impersonation via Google Group relay with suspicious indicators severity high
• VIP impersonation with BEC language (near match, untrusted sender) severity medium
• VIP impersonation with charitable donation fraud severity high
• VIP impersonation with invoicing request severity high
• VIP impersonation with urgent request (strict match, untrusted sender) severity high
• VIP impersonation with w2 request with reply-to mismatch severity high
• VIP impersonation: Fake thread with display name match, email mismatch severity medium
• Xero infrastructure abuse severity medium