Sublime-Message-headers Event ID 7000010

Sublime MQL (50)

• Attachment: EML with Sharepoint link likely unrelated to sender severity medium
• Attachment: Fake secure message and suspicious indicators severity medium
• Brand impersonation: Adobe with suspicious language and link severity high
• Brand impersonation: AliExpress severity medium
• Brand impersonation: Aquent severity medium
• Brand impersonation: Box file sharing service severity medium
• Brand impersonation: DocuSign severity high
• Brand impersonation: Mailgun severity medium
• Brand impersonation: Microsoft with embedded logo and credential theft language severity high
• Brand impersonation: Microsoft with low reputation links severity medium
• Brand impersonation: Morgan Stanley severity medium
• Brand impersonation: Okta severity medium
• Brand impersonation: Wix severity medium
• Callback phishing in body or attachment (untrusted sender) severity medium
• ClickFunnels link infrastructure abuse severity high
• Compensation review with QR code in attached EML severity high
• Credential phishing: 'Secure message' and engaging language severity medium
• Credential phishing: Email delivery failure impersonation severity high
• Credential phishing: Fake storage alerts (unsolicited) severity medium
• EML attachment with credential theft language (unknown sender) severity high
• Fake email quarantine notification severity high
• Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
• Fake thread with suspicious indicators severity medium
• Fake voicemail notification (untrusted sender) severity medium
• Impersonation: Internal corporate services severity high
• Link: Credential phishing traversing Russian infrastructure severity high
• Link: Referrer anonymization service from untrusted sender severity medium
• Link: Squarespace infrastructure abuse severity medium
• Open redirect: bubblelife.com severity medium
• Open redirect: convertcart.com severity medium
• Open redirect: magic4media.com severity medium
• Open redirect: pmifunds.com severity medium
• Open redirect: predictiveresponse.net severity medium
• Open redirect: qrxtech.com severity medium
• Open redirect: secondstreetapp.com severity medium
• Open redirect: Signature Travel Network severity medium
• Open redirect: smartadserver.com severity medium
• Open redirect: tuttocauzioni.it severity medium
• Open redirect: weblinkconnect.com severity medium
• Service Abuse: ExactTarget with suspicious sender indicators severity high
• Service abuse: Free provider with SendGrid routing severity medium
• Service abuse: Monday.com infrastructure with phishing intent severity high
• Service abuse: Sendgrid credential theft with personalized request targeting single recipient severity medium
• Service abuse: SendGrid impersonation via Sendgrid from new sender severity high
• Spam/fraud: Predatory journal/research paper request severity medium
• Spam: BlackBaud infrastructure abuse severity medium
• Spam: Personalized subject and greetings via Salesforce Marketing Cloud severity low
• Spam: Sendersrv.com with financial communications and unsubscribe language severity medium
• Spoofable internal domain with suspicious signals severity medium
• Vendor compromise: GovDelivery message with suspicious link severity high