Sublime-Message-headers Event ID 7000013

Sublime MQL (36)

• BEC with unusual reply-to or return-path mismatch severity high
• Brand impersonation: Google Drive fake file share severity medium
• Brand impersonation: Greenvelope severity medium
• Brand impersonation: Ledger severity low
• Brand impersonation: LinkedIn severity medium
• Brand impersonation: Microsoft fake sign-in alert severity medium
• Brand impersonation: Microsoft with embedded logo and credential theft language severity high
• Business Email Compromise (BEC) attempt from unsolicited sender severity medium
• Callback phishing: Branded invoice from sender/reply-to domain less than 30 days old severity medium
• Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
• Cyrillic vowel substitution in subject or display name from unknown sender severity medium
• Fake request for tax preparation severity high
• Fake shipping notification with link to free file hosting severity low
• Fake thread with suspicious indicators severity medium
• Google Notification alert link from non-Google sender severity medium
• Inbound message from popular service via newly observed distribution list severity medium
• Invoicera infrastructure abuse severity medium
• Link: File sharing impersonation with suspicious language and sending patterns severity medium
• Link: Free file hosting with undisclosed recipients severity medium
• Link: Squarespace infrastructure abuse severity medium
• Message traversed multiple onmicrosoft.com tenants severity medium
• Microsoft infrastructure abuse with suspicious patterns severity high
• Open redirect: bestdeals.today severity medium
• Open redirect: isadatalab.com severity medium
• Open redirect: queue.swytchbike.com severity medium
• Open redirect: Ticketmaster severity low
• Russia return-path TLD (untrusted sender) severity low
• Salesforce infrastructure abuse severity medium
• Sendgrid onmicrosoft.com domain phishing severity medium
• Sendgrid voicemail phish severity high
• Service abuse: AWS SNS callback scam impersonation severity medium
• Service abuse: GitHub notification with excessive mentions and suspicious links severity high
• Service abuse: Task management message sent via SendGrid severity medium
• Suspicious mailer received from Gmail servers severity low
• Tax Form: W-8BEN solicitation severity medium
• VIP Impersonation via Google Group relay with suspicious indicators severity high