Sublime-Message-headers Event ID 7000009

Sublime MQL (435)

• Attachment: Adobe image lure in body or attachment with suspicious link severity medium
• Attachment: Any .sap file (unsolicited) severity low
• Attachment: Any HTML file (unsolicited) severity low
• Attachment: Any HTML file (untrusted sender) severity medium
• Attachment: Compensation review lure with QR code severity high
• Attachment: Compensation-themed DOCX with QR code credential theft severity high
• Attachment: DocuSign impersonation via PDF linking to new domain severity medium
• Attachment: EML file with HTML attachment (unsolicited) severity medium
• Attachment: EML with Sharepoint link likely unrelated to sender severity medium
• Attachment: EML with suspicious indicators severity medium
• Attachment: Encrypted PDF with credential theft body severity medium
• Attachment: Fake attachment image lure severity medium
• Attachment: Fake secure message and suspicious indicators severity medium
• Attachment: Fake voicemail via PDF severity medium
• Attachment: HTML attachment with login portal indicators severity medium
• Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts severity high
• Attachment: HTML smuggling - QR Code with suspicious links severity high
• Attachment: HTML smuggling with atob and high entropy severity high
• Attachment: HTML smuggling with atob and high entropy via calendar invite severity high
• Attachment: HTML smuggling with decimal encoding severity high
• Attachment: HTML with emoji-to-character map severity high
• Attachment: HTML with hidden body severity high
• Attachment: HTML with JavaScript functions for HTTP requests severity high
• Attachment: ICS calendar with embedded file from internal sender with SPF failure severity high
• Attachment: Invoice and W-9 PDFs with suspicious creators severity high
• Attachment: Microsoft 365 credential phishing severity high
• Attachment: Microsoft impersonation via PDF with link and suspicious language severity high
• Attachment: PDF proposal with credential theft indicators severity high
• Attachment: PDF with credential theft language and invalid reply-to domain severity medium
• Attachment: PDF with Microsoft Purview message impersonation severity medium
• Attachment: PDF with suspicious HeadlessChrome metadata severity medium
• Attachment: QR code with credential phishing indicators severity medium
• Attachment: Suspicious employee policy update document lure severity medium
• BEC with unusual reply-to or return-path mismatch severity high
• BEC/Fraud: Generic scam attempt to undisclosed recipients severity low
• BEC/Fraud: Penpal scam severity medium
• Benefits enrollment impersonation severity high
• Body HTML: Recipient SLD in HTML class severity medium
• Body: Embedded email headers indicative of thread hijacking/abuse severity medium
• Body: HTML whitespace stuffing with short initial message severity medium
• Brand impersonation: AARP severity medium
• Brand impersonation: Adobe (QR code) severity high
• Brand impersonation: Adobe Sign with suspicious indicators severity high
• Brand impersonation: Adobe with suspicious language and link severity high
• Brand impersonation: AliExpress severity medium
• Brand impersonation: Amazon severity low
• Brand impersonation: Amazon Web Services (AWS) severity medium
• Brand impersonation: American Express (AMEX) severity low
• Brand impersonation: Aquent severity medium
• Brand impersonation: Aramco severity medium
• Brand impersonation: AuthentiSign severity medium
• Brand impersonation: Automobile assistance associations severity high
• Brand impersonation: Bank of America severity high
• Brand impersonation: Blockchain.com severity medium
• Brand impersonation: Booking.com severity medium
• Brand impersonation: Box file sharing service severity medium
• Brand impersonation: Canada Revenue Agency severity medium
• Brand impersonation: Capital One severity high
• Brand impersonation: Charles Schwab severity medium
• Brand impersonation: Chase Bank severity high
• Brand impersonation: Chase bank with credential phishing indicators severity medium
• Brand impersonation: Cloud services with credential theft intent severity medium
• Brand impersonation: Coinbase severity high
• Brand impersonation: Dashlane severity medium
• Brand impersonation: DHL severity low
• Brand impersonation: Discord notification severity medium
• Brand Impersonation: Disney severity medium
• Brand impersonation: DocSend severity high
• Brand impersonation: DocuSign severity high
• Brand impersonation: DocuSign (QR code) severity high
• Brand impersonation: DocuSign with embedded QR code severity high
• Brand impersonation: DoorDash severity medium
• Brand impersonation: Dotloop severity medium
• Brand impersonation: Dropbox severity medium
• Brand impersonation: Evite severity medium
• Brand impersonation: Fake Fax severity medium
• Brand impersonation: Fastway severity medium
• Brand impersonation: FedEx severity low
• Brand impersonation: File sharing notification with template artifacts severity low
• Brand Impersonation: Gemini Trust Company severity medium
• Brand impersonation: Github severity high
• Brand impersonation: GoDaddy severity medium
• Brand impersonation: Google Careers severity high
• Brand impersonation: Google Drive fake file share severity medium
• Brand impersonation: Google Workspace alert notification severity medium
• Brand impersonation: Greenvelope severity medium
• Brand impersonation: Gusto severity medium
• Brand impersonation: Hulu severity medium
• Brand impersonation: Interac severity medium
• Brand impersonation: Internal Revenue Service severity high
• Brand impersonation: KnowBe4 severity medium
• Brand impersonation: LastPass severity high
• Brand impersonation: Ledger severity low
• Brand impersonation: Mailchimp severity medium
• Brand impersonation: Mailgun severity medium
• Brand impersonation: Marriott with gift language severity medium
• Brand impersonation: McAfee severity medium
• Brand impersonation: Meta and subsidiaries severity medium
• Brand impersonation: MetaMask severity high
• Brand impersonation: Microsoft severity high
• Brand impersonation: Microsoft Planner with suspicious link severity medium
• Brand impersonation: Microsoft quarantine release notification in body severity high
• Brand impersonation: Microsoft quarantine release notification in image attachment severity high
• Brand impersonation: Microsoft Teams invitation severity high
• Brand impersonation: Microsoft with embedded logo and credential theft language severity high
• Brand impersonation: Microsoft with low reputation links severity medium
• Brand impersonation: Morgan Stanley severity medium
• Brand impersonation: Navan severity medium
• Brand impersonation: Netflix severity low
• Brand impersonation: Office 365 mail service severity medium
• Brand impersonation: Okta severity medium
• Brand impersonation: OpenAI with payment issues severity high
• Brand impersonation: Paperless Post severity high
• Brand Impersonation: PayPal severity medium
• Brand impersonation: PNC severity medium
• Brand Impersonation: Procore severity medium
• Brand impersonation: Purdue ePlanroom with suspicious links severity medium
• Brand impersonation: Quickbooks severity medium
• Brand impersonation: QuickBooks dispute notification severity high
• Brand impersonation: QuickBooks notification from Intuit themed company name severity medium
• Brand impersonation: Robert Half severity medium
• Brand impersonation: Robinhood severity medium
• Brand impersonation: SendGrid severity medium
• Brand Impersonation: ShareFile severity medium
• Brand impersonation: Sharepoint severity high
• Brand impersonation: Sharepoint fake file share severity medium
• Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
• Brand Impersonation: Shein severity medium
• Brand impersonation: SiriusXM severity medium
• Brand impersonation: Social Security Administration severity medium
• Brand impersonation: Spotify severity low
• Brand impersonation: Square severity medium
• Brand impersonation: Squarespace severity medium
• Brand impersonation: State Farm severity medium
• Brand Impersonation: Stripe severity high
• Brand impersonation: Stripe notification severity medium
• Brand impersonation: Sublime Security severity high
• Brand impersonation: Survey request with credential theft indicators severity medium
• Brand impersonation: TikTok severity medium
• Brand impersonation: Toronto-Dominion Bank severity medium
• Brand impersonation: Trust Wallet severity high
• Brand impersonation: TurboTax severity low
• Brand impersonation: UK government Home Office severity high
• Brand impersonation: United Healthcare severity medium
• Brand impersonation: UPS severity low
• Brand impersonation: USPS severity high
• Brand impersonation: Vanguard severity medium
• Brand impersonation: Vanta severity low
• Brand impersonation: Venmo severity medium
• Brand impersonation: Wells Fargo severity high
• Brand impersonation: WeTransfer severity high
• Brand impersonation: Wise severity high
• Brand impersonation: Wix severity medium
• Brand impersonation: Xodo Sign severity medium
• Brand impersonation: Zoom severity medium
• Brand spoof: Dropbox severity medium
• Business Email Compromise (BEC) attempt from unsolicited sender severity medium
• Business Email Compromise (BEC) attempt from untrusted sender severity medium
• Business Email Compromise (BEC) attempt from untrusted sender (French/Français) severity medium
• Business Email Compromise: Request for mobile number via reply thread hijacking severity medium
• Callback phishing in body or attachment (untrusted sender) severity medium
• Callback phishing solicitation in message body severity medium
• Callback phishing via Adobe Sign comment severity high
• Callback phishing via calendar invite severity medium
• Callback phishing via DocuSign comment severity high
• Callback phishing via e-signature service severity high
• Callback phishing via extensionless rfc822 attachment severity high
• Callback phishing via Google Group abuse severity high
• Callback phishing via Intuit service abuse severity medium
• Callback Phishing via Signable E-Signature Request severity high
• Callback phishing via SignFree e-signature request severity high
• Callback phishing via Xodo Sign comment severity high
• Callback phishing via Zoho service abuse severity medium
• Callback Phishing via Zoom comment severity medium
• Catbox.moe link from untrusted source severity medium
• Cloud storage impersonation with credential theft indicators severity medium
• Commonly abused sender TLD with engaging language severity medium
• Compensation review with QR code in attached EML severity high
• Constant Contact link infrastructure abuse severity high
• COVID-19 themed fraud with sender and reply-to mismatch or compensation award severity medium
• Credential phishing content and link (untrusted sender) severity high
• Credential phishing language and suspicious indicators (unknown sender) severity medium
• Credential phishing link (unknown sender) severity high
• Credential Phishing via Dropbox comment abuse severity medium
• Credential phishing: 'Secure message' and engaging language severity medium
• Credential phishing: Blue button styled link with file-sharing template artifacts severity low
• Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
• Credential phishing: Email delivery failure impersonation severity high
• Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
• Credential phishing: Fake card notification with tracking lure severity medium
• Credential phishing: Fake password expiration from new and unsolicited sender severity medium
• Credential phishing: Fake storage alerts (unsolicited) severity medium
• Credential phishing: Financial lure via ActiveCampaign infrastructure severity medium
• Credential phishing: Generic document share template severity low
• Credential phishing: Generic document sharing severity medium
• Credential phishing: Onedrive impersonation severity high
• Credential phishing: Re-Authentication lure severity high
• Credential phishing: Suspicious e-sign agreement document notification severity medium
• Credential phishing: Suspicious subject with urgent financial request and link severity medium
• Credential phishing: Tax form impersonation with payment request severity medium
• Display name and subject impersonation using recipient SLD (new sender) severity medium
• Display Name Emoji with Financial Symbols severity low
• Display name impersonation using recipient SLD severity medium
• DocuSign impersonation via spoofed Intuit sender severity high
• EML attachment with credential theft language (unknown sender) severity high
• Employee impersonation with urgent request (untrusted sender) severity medium
• Extortion / sextortion (untrusted sender) severity low
• Fake email quarantine notification severity high
• Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
• Fake thread with suspicious indicators severity medium
• Fake voicemail notification (untrusted sender) severity medium
• Fake Zoom meeting invite with suspicious link severity medium
• File sharing link with a suspicious subject severity medium
• Free subdomain link with login or captcha (untrusted sender) severity medium
• Google Drive direct download link from unsolicited sender severity medium
• Google Notification alert link from non-Google sender severity medium
• Google presentation open redirect phishing severity medium
• Google services using g.co shortlinks severity medium
• Google share notification with suspicious comments severity high
• Hardbacon infrastructure abuse severity high
• Headers: Self-sender using Microsoft CompAuth bypass with credential theft content severity high
• Honorific greeting BEC attempt with sender and reply-to mismatch severity low
• HR impersonation via e-sign agreement comment severity high
• HTML smuggling containing recipient email address severity medium
• Image as content with a link to an open redirect severity high
• Impersonation using recipient domain (untrusted sender) severity medium
• Impersonation: Chrome Web Store policy severity low
• Impersonation: Fake Gmail attachment severity high
• Impersonation: Fake product discount promotion severity medium
• Impersonation: Human Resources with link or attachment and engaging language severity medium
• Impersonation: Internal corporate services severity high
• Inbound message from popular service via newly observed distribution list severity medium
• Job scam (unsolicited sender) severity low
• Job scam with specific salary pattern severity low
• Link to auto-downloaded DMG in archive severity medium
• Link to auto-downloaded DMG in encrypted zip severity high
• Link: .onion From Unsolicited Sender severity low
• Link: Adobe share from unsolicited sender severity medium
• Link: Adobe share with suspicious indicators severity high
• Link: BEC with newly registered domains and financial keywords severity medium
• Link: Common hidden directory observed severity medium
• Link: Credential phishing link with undisclosed recipients severity medium
• Link: Cryptocurrency fraud with suspicious links severity high
• Link: Direct link to limewire hosted file severity high
• Link: Direct link to riddle.com hosted showcase severity medium
• Link: Direct link to Zoom Docs from non-Zoom sender severity medium
• Link: Executable file download with suspicious message content severity high
• Link: File sharing impersonation with suspicious language and sending patterns severity medium
• Link: Financial account issue with suspicious indicators severity medium
• Link: Flagged bit.ly link severity medium
• Link: Free file hosting with undisclosed recipients severity medium
• Link: GoPhish query param values severity low
• Link: Hotel booking spoofed display URL severity medium
• Link: IPFS severity medium
• Link: Jensi file preview link from unsolicited sender severity medium
• Link: Microsoft Dynamics 365 form phishing severity high
• Link: Multistage landing - Abused Docusign severity high
• Link: Multistage landing - Abused Google Drive severity high
• Link: Multistage landing - Ludus presentation severity medium
• Link: Multistage landing - Scribd document severity medium
• Link: Non-standard port 8443 in display URL severity medium
• Link: Personalized URL with recipient address on commonly abused web service severity medium
• Link: QR code with phishing disposition in img or pdf severity high
• Link: QR Code with suspicious language (untrusted sender) severity medium
• Link: QuickBooks image lure with suspicious link severity medium
• Link: Recipient domain in URL path severity high
• Link: Referrer anonymization service from untrusted sender severity medium
• Link: Suspicious Sharepoint folder share severity high
• Link: Tax document lure Portuguese/Spanish with suspicious domains severity medium
• Link: Webflow link from unsolicited sender severity medium
• Link: Zoho form link from unsolicited sender severity medium
• Lookalike sender domain (untrusted sender) severity high
• macOS malware: Compiled AppleScript with document double-extension severity high
• Malware: Pikabot delivery via URL auto-download severity high
• Mass campaign: recipient address in subject, body, and link (untrusted sender) severity medium
• Open redirect: adnxs.com severity medium
• Open redirect: agena-smile.com severity medium
• Open redirect: amaterasu-for-website-5.com severity medium
• Open redirect: api.spently.com severity medium
• Open redirect: Artisteer severity medium
• Open redirect: artkaderne severity medium
• Open Redirect: asemailmgmteu.com severity medium
• Open redirect: astroarts.co.jp severity medium
• Open redirect: bananaguide.com severity medium
• Open redirect: bangkoksync.com severity medium
• Open redirect: bestdeals.today severity medium
• Open redirect: Bitrix24 URL Path severity medium
• Open redirect: bubblelife.com severity medium
• Open redirect: buildingengines.com severity medium
• Open redirect: business.google.com website_shared URL Param severity medium
• Open redirect: chkc.com.hk severity medium
• Open redirect: City of Calgary severity medium
• Open redirect: Club-OS severity medium
• Open redirect: convertcart.com severity medium
• Open redirect: Dell severity medium
• Open redirect: designsori.com severity medium
• Open redirect: documentmailbox.com severity medium
• Open redirect: eaoko.org severity medium
• Open redirect: easycamp.com severity medium
• Open redirect: embluemail.com severity medium
• Open redirect: emlakarsa severity medium
• Open redirect: emp.eduyield.com severity medium
• Open redirect: eodcnetworkdirect.com severity medium
• Open redirect: events.csiro.au severity medium
• Open redirect: ExacTag severity medium
• Open redirect: fenc.com severity medium
• Open redirect: g7.fr severity medium
• Open redirect: giving.lluh.org severity medium
• Open Redirect: Google domain with /url path and suspicious indicators severity medium
• Open redirect: ijf.org severity medium
• Open redirect: Indeed severity medium
• Open redirect: IndiaTimes severity medium
• Open redirect: isadatalab.com severity medium
• Open redirect: k-mil.net severity medium
• Open redirect: labcluster.com severity medium
• Open redirect: LearningApps severity medium
• Open redirect: LinkedIn Redirect severity medium
• Open redirect: listing.ca severity medium
• Open redirect: magic4media.com severity medium
• Open redirect: magiccity.ne.jp severity medium
• Open redirect: magneticmarketing.com severity medium
• Open redirect: mail.spiceworks.com severity medium
• Open redirect: marketing.edinburghairport.com severity medium
• Open redirect: Medium severity medium
• Open redirect: mindmixer.com severity medium
• Open redirect: museepicassoparis.fr severity medium
• Open redirect: Newegg severity medium
• Open redirect: next2.io severity medium
• Open redirect: nowlifestyle.com severity medium
• Open redirect: obunsha.co.jp severity medium
• Open redirect: people.anuneo.com severity medium
• Open redirect: phoenixartstudio.net severity medium
• Open redirect: PIRL San Diego severity medium
• Open redirect: plasticsurgery.or.kr severity medium
• Open redirect: pmifunds.com severity medium
• Open redirect: predictiveresponse.net severity medium
• Open redirect: PremierBet severity medium
• Open redirect: qrxtech.com severity medium
• Open redirect: queue.swytchbike.com severity medium
• Open redirect: radiopublic.com severity medium
• Open redirect: retailrocket.net severity medium
• Open redirect: ringaraja.net severity medium
• Open redirect: sciencebuddies.org severity medium
• Open redirect: secondstreetapp.com severity medium
• Open redirect: shoppermeet.net severity medium
• Open redirect: shoppingwebapi.didatravel.com severity medium
• Open redirect: Signature Travel Network severity medium
• Open redirect: slubnaglowie.pl severity medium
• Open redirect: smartadserver.com severity medium
• Open redirect: smore.com severity medium
• Open redirect: social.bigpress.net severity medium
• Open redirect: ssg-financial.com severity medium
• Open redirect: stats.lib.pdx.edu severity medium
• Open redirect: storematch.jp severity medium
• Open redirect: Ticketmaster severity low
• Open redirect: TikTok severity medium
• Open redirect: tkqlhce.com severity medium
• Open redirect: tuttocauzioni.it severity medium
• Open redirect: typedrawers.com severity medium
• Open redirect: unitedwaynwvt.org severity medium
• Open redirect: ust.hk severity medium
• Open redirect: vconfex.com severity medium
• Open redirect: weblinkconnect.com severity medium
• Open redirect: whitefox.pl severity medium
• Open redirect: Xfinity CMP Redirection to Google AMP severity medium
• Open redirect: xfinity.com severity medium
• Open redirect: YouTube severity medium
• Potential prompt injection attack in body HTML severity high
• QR code to auto-download of a suspicious file type (unsolicited) severity high
• QR Code with suspicious indicators severity high
• Reconnaissance: All recipients cc/bcc'd or undisclosed severity low
• Reconnaissance: Large unknown recipient list severity low
• Reconnaissance: Short generic greeting message severity medium
• Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
• Salesforce infrastructure abuse severity medium
• Scam soliciting employer review/rating severity low
• Scam: Piano giveaway severity medium
• Sender name contains Active Directory distinguished name severity medium
• Service abuse: Adobe Creative Cloud share from an unsolicited sender address severity low
• Service abuse: Adobe Sign notification from an unsolicited reply-to address severity medium
• Service abuse: Behance document sharing with suspicious language severity medium
• Service abuse: DocSend share from newly registered domain severity high
• Service abuse: DocuSign notification with suspicious sender or document name severity medium
• Service abuse: DocuSign share from an unsolicited reply-to address severity medium
• Service abuse: Dropbox share from an unsolicited reply-to address severity medium
• Service abuse: Dropbox share from new domain severity medium
• Service abuse: Dropbox share with suspicious sender or document name severity medium
• Service Abuse: GoDaddy infrastructure severity medium
• Service abuse: Google application integration redirecting to suspicious hosts severity medium
• Service abuse: HelloSign from an unsolicited sender address severity low
• Service Abuse: HelloSign share with suspicious sender or document name severity medium
• Service abuse: Meetup.com redirect with brand impersonation severity medium
• Service abuse: Monday.com infrastructure with phishing intent severity high
• Service abuse: QuickBooks notification from new domain severity medium
• Service abuse: SendGrid impersonation via Sendgrid from new sender severity high
• Service abuse: SurveyMonkey survey from newly registered domain severity high
• Service abuse: Task management message sent via SendGrid severity medium
• Sharepoint link likely unrelated to sender severity medium
• Spam/fraud: Predatory journal/research paper request severity medium
• Spam: Cryptocurrency airdrop/giveaway severity low
• Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
• Spam: Fake photo share severity low
• Spam: Firebase password reset from suspicious sender severity low
• Spam: Ghostwriting services scam with manipulative language severity medium
• Spam: Item giveaway spam template severity low
• Spam: Mastercard promotional content with image-based body severity low
• Spam: Single recipient duplicated in cc severity medium
• Spam: Unsolicited WordPress account creation or password reset request severity low
• Stripe invoice abuse severity medium
• Suspicious attachment with unscannable Cloudflare link severity medium
• Suspicious DocuSign share from new domain severity high
• Suspicious invoice reference with missing or image-only attachments severity high
• Suspicious link to Looker Studio (lookerstudio.google.com) from a new and unsolicited sender severity medium
• Suspicious Links to Cloudflare R2 and Edge Services severity medium
• Suspicious message with unscannable Cloudflare link severity medium
• Suspicious message with unscannable Vercel link severity medium
• Suspicious newly registered reply-to domain with engaging financial or urgent language severity medium
• Suspicious recipients pattern with no Compauth pass and suspicious content severity medium
• Suspicious request for financial information severity high
• Suspicious sender display name with long procedurally generated text blob severity medium
• Suspicious subject with long procedurally generated text blob severity medium
• Truth Social infrastructure abuse via link redirect severity medium
• Twitter infrastructure abuse via link shortener severity medium
• Unusually long local part from untrusted sender address severity low
• Vendor compromise: GovDelivery message with suspicious link severity high
• VIP / Executive impersonation (strict match, untrusted) severity high
• VIP / Executive impersonation in subject (untrusted) severity medium
• VIP Impersonation via Google Group relay with suspicious indicators severity high
• VIP impersonation with BEC language (near match, untrusted sender) severity medium
• VIP impersonation with invoicing request severity high
• VIP impersonation with urgent request (strict match, untrusted sender) severity high
• VIP impersonation with w2 request with reply-to mismatch severity high
• VIP local_part impersonation from unsolicited sender severity high
• X (Twitter) impersonation with credential phishing motives severity medium
• Zoom Events newsletter abuse severity medium