Detection rules › By catalog entry

Sublime-Message-sender

Catalog entry	Rules
sender	228
sender.email	763

sender

228 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (228)

Attachment with VBA macros from employee impersonation (unsolicited) severity high
Attachment: EML with link to credential phishing page severity high
Attachment: Legal themed message or PDF with suspicious indicators severity medium
Attachment: PDF bid/proposal lure with credential theft indicators severity medium
Attachment: QR code link with base64-encoded recipient address severity high
BEC with unusual reply-to or return-path mismatch severity high
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply severity medium
BEC/Fraud: Romance scam severity medium
BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread severity medium
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium
Benefits enrollment impersonation severity high
Brand impersonation: AARP severity medium
Brand impersonation: Adobe (QR code) severity high
Brand impersonation: ADP severity medium
Brand impersonation: Amazon severity low
Brand impersonation: Amazon Web Services (AWS) severity medium
Brand impersonation: Amazon with suspicious attachment severity medium
Brand impersonation: American Express (AMEX) severity low
Brand impersonation: Anthropic/Claude with newly registered domain severity medium
Brand impersonation: Apple severity high
Brand impersonation: Aquent severity medium
Brand impersonation: Aramco severity medium
Brand impersonation: AuthentiSign severity medium
Brand impersonation: Bank of America severity high
Brand impersonation: Barracuda Networks severity medium
Brand impersonation: Binance severity medium
Brand impersonation: Blockchain.com severity medium
Brand impersonation: Booking.com severity medium
Brand impersonation: Canada Revenue Agency severity medium
Brand impersonation: Capital One severity high
Brand impersonation: Charles Schwab severity medium
Brand impersonation: Chase Bank severity high
Brand impersonation: Coinbase severity high
Brand impersonation: Dashlane severity medium
Brand impersonation: DHL severity low
Brand impersonation: DigitalOcean severity high
Brand impersonation: Discord notification severity medium
Brand Impersonation: Disney severity medium
Brand impersonation: DocSend severity high
Brand impersonation: DocuSign severity high
Brand impersonation: DocuSign branded attachment lure with no DocuSign links severity high
Brand impersonation: DoorDash severity medium
Brand impersonation: Dotloop severity medium
Brand impersonation: Dropbox severity medium
Brand impersonation: Enbridge severity medium
Brand impersonation: Exodus severity low
Brand impersonation: Fake Fax severity medium
Brand impersonation: Fastway severity medium
Brand impersonation: FedEx severity low
Brand impersonation: FINRA severity medium
Brand Impersonation: Gemini Trust Company severity medium
Brand impersonation: Github severity high
Brand impersonation: GoDaddy severity medium
Brand Impersonation: Google (QR Code) severity high
Brand impersonation: Google Drive fake file share severity medium
Brand impersonation: Google using Microsoft Forms severity high
Brand impersonation: Google Workspace alert notification severity medium
Brand impersonation: Government / Tax Authority document lure severity medium
Brand impersonation: Gusto severity medium
Brand impersonation: Hulu severity medium
Brand impersonation: Interac severity medium
Brand impersonation: Internal Revenue Service severity high
Brand impersonation: KnowBe4 severity medium
Brand impersonation: LastPass severity high
Brand impersonation: Ledger severity low
Brand impersonation: LinkedIn severity medium
Brand impersonation: Mailchimp severity medium
Brand impersonation: Mailgun severity medium
Brand impersonation: Marriott with gift language severity medium
Brand impersonation: McAfee severity medium
Brand impersonation: Meta and subsidiaries severity medium
Brand impersonation: MetaMask severity high
Brand impersonation: Microsoft severity high
Brand impersonation: Microsoft (QR code) severity high
Brand impersonation: Microsoft fake sign-in alert severity medium
Brand impersonation: Microsoft Teams invitation severity high
Brand impersonation: Morgan Stanley severity medium
Brand impersonation: MyChart severity medium
Brand impersonation: Navan severity medium
Brand impersonation: Netflix severity low
Brand impersonation: Okta severity medium
Brand Impersonation: OpenAI with ChatGPT Ads lure severity high
Brand impersonation: OpenAI with payment issues severity high
Brand Impersonation: PayPal severity medium
Brand impersonation: PNC severity medium
Brand Impersonation: Procore severity medium
Brand impersonation: QuickBooks severity medium
Brand impersonation: QuickBooks dispute notification severity high
Brand impersonation: Ripple severity low
Brand impersonation: Robert Half severity medium
Brand impersonation: Robinhood severity medium
Brand impersonation: Sedgwick Claims severity medium
Brand impersonation: SendGrid severity medium
Brand Impersonation: ShareFile severity medium
Brand impersonation: Sharepoint fake file share severity medium
Brand Impersonation: Shein severity medium
Brand impersonation: Silicon Valley Bank severity medium
Brand impersonation: SiriusXM severity medium
Brand impersonation: Social Security Administration severity medium
Brand impersonation: SoFi severity medium
Brand impersonation: Spotify severity low
Brand impersonation: Square severity medium
Brand impersonation: Squarespace severity medium
Brand impersonation: State Farm severity medium
Brand impersonation: Stellar Development Foundation (SDF) severity low
Brand Impersonation: Stripe severity high
Brand impersonation: Stripe notification severity medium
Brand impersonation: Sublime Security severity high
Brand impersonation: TikTok severity medium
Brand impersonation: Toronto-Dominion Bank severity medium
Brand impersonation: Trust Wallet severity high
Brand impersonation: TurboTax severity low
Brand impersonation: Twitter severity medium
Brand impersonation: UK government Home Office severity high
Brand impersonation: ukr[.]net severity medium
Brand impersonation: United Healthcare severity medium
Brand impersonation: United States Patent and Trademark Office severity medium
Brand impersonation: UPS severity low
Brand impersonation: USPS severity high
Brand impersonation: Vanguard severity medium
Brand impersonation: Vanta severity low
Brand impersonation: Venmo severity medium
Brand impersonation: Wells Fargo severity high
Brand impersonation: WeTransfer severity high
Brand impersonation: Wise severity high
Brand impersonation: Wix severity medium
Brand impersonation: Zoom (strict) severity medium
Business Email Compromise (BEC) attempt from unsolicited sender severity medium
Business Email Compromise (BEC) with request for mobile number severity medium
Business Email Compromise: Request for mobile number via reply thread hijacking severity medium
Callback Phishing via Zoom comment severity medium
Cloud storage impersonation with credential theft indicators severity medium
Commonly abused sender TLD with engaging language severity medium
Credential phishing content and link (untrusted sender) severity high
Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
Credential phishing: Email delivery failure impersonation severity high
Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
Credential phishing: Fake storage alerts (unsolicited) severity medium
Credential phishing: Hyper-linked image leading to free file host severity medium
Credential phishing: Onedrive impersonation severity high
Credential phishing: Suspicious e-sign agreement document notification severity medium
Cyrillic vowel substitution in subject or display name from unknown sender severity medium
Cyrillic vowel substitutions with suspicious subject from unknown sender severity medium
Display name and subject impersonation using recipient SLD (new sender) severity medium
Display Name Emoji with Financial Symbols severity low
Display name impersonation using recipient SLD severity medium
DocuSign impersonation via CloudHQ links severity medium
DocuSign impersonation via spoofed Intuit sender severity high
Employee impersonation with urgent request (untrusted sender) severity medium
Employee impersonation: Payroll fraud severity high
Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
Fake request for tax preparation severity high
Fake thread with suspicious indicators severity medium
Fake voicemail notification (untrusted sender) severity medium
Fraudulent order confirmation/shipping notification from Chinese sender domain severity medium
Google presentation open redirect phishing severity medium
Google share notification with suspicious comments severity high
Headers: System account impersonation with empty sender address severity medium
HTML smuggling containing recipient email address severity medium
Impersonation using recipient domain (untrusted sender) severity medium
Impersonation: Chrome Web Store policy severity low
Impersonation: Employee name in subject with suspicious sender severity medium
Impersonation: Employee using fabricated identity in initial contact severity high
Impersonation: HR administrative center PDF password lure severity medium
Impersonation: Human Resources with link or attachment and engaging language severity medium
Impersonation: Internal corporate services severity high
Impersonation: Legal firm with copyright infringement notice severity medium
Impersonation: Recipient organization in sender display name with credential theft image severity medium
Impersonation: Salesforce fake campaign failure notification severity medium
Impersonation: SAM/SBA federal registration severity high
Link to Google Apps Script macro via comment tagging severity medium
Link: Adobe share from unsolicited sender severity medium
Link: Adobe share with suspicious indicators severity high
Link: Fake forwarded message with suspicious URL in plain text severity medium
Link: HR impersonation with suspicious domain indicators and credential theft severity high
Link: Job recruitment lure from unsolicited sender with suspicious hosting severity medium
Link: Microsoft impersonation using hosted png with suspicious link severity medium
Link: Mismatched Shopify template button href severity medium
Link: Multistage landing - Abused Google Drive severity high
Link: Uncommon SharePoint document type with sender's display name severity medium
Link: Unicode character obfuscation in display name with base64-encoded URL fragment severity medium
QR Code with suspicious indicators severity high
Reconnaissance: Short generic greeting message severity medium
Self-impersonation: Sender matches recipient with bolded name and suspicious link severity medium
Self-sender with copy/paste instructions and suspicious domains (French/Français) severity medium
Sender name contains Active Directory distinguished name severity medium
Service abuse: AppSheet infrastructure with suspicious indicators severity medium
Service abuse: DocuSign notification with suspicious sender or document name severity medium
Service Abuse: ExactTarget with suspicious sender indicators severity high
Service abuse: Facebook mail notification callback scam severity medium
Service abuse: File sharing impersonation with external SharePoint links severity medium
Service abuse: GitHub notification with excessive mentions and suspicious links severity high
Service Abuse: GoDaddy infrastructure severity medium
Service Abuse: HelloSign share with suspicious sender or document name severity medium
Service abuse: Notion free-tier account impersonating VIP severity medium
Service abuse: SendGrid impersonation via Sendgrid from new sender severity high
Service abuse: Substack credential theft with confusable characters and branded button redirects severity medium
Service abuse: Suspicious Zoom Docs link severity low
Service abuse: Wufoo credential theft severity medium
Sharepoint online with external recipients and external display name severity medium
Spam: Attendee list solicitation severity low
Spam: Commonly observed formatting of unauthorized free giveaways severity low
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
Spam: Fake photo share severity low
Spoofable internal domain with suspicious signals severity medium
Subject and sender display name contains matching long alphanumeric string severity low
Suspected cross-site scripting (XSS) found in subject severity medium
Suspicious attachment with unscannable Cloudflare link severity medium
Suspicious display name: Gmail sender with engaging language severity low
Suspicious message with unscannable Cloudflare link severity medium
Suspicious message with unscannable Vercel link severity medium
Suspicious request for financial information severity high
Suspicious sender display name with long procedurally generated text blob severity medium
Suspicious subject with long procedurally generated text blob severity medium
Vendor impersonation: Thread hijacking with typosquat domain severity high
VIP / Executive impersonation (strict match, untrusted) severity high
VIP / Executive impersonation in subject (untrusted) severity medium
VIP Impersonation via Google Group relay with suspicious indicators severity high
VIP impersonation with BEC language (near match, untrusted sender) severity medium
VIP impersonation with invoicing request severity high
VIP impersonation with urgent request (strict match, untrusted sender) severity high
VIP impersonation with w2 request with reply-to mismatch severity high
VIP impersonation: Fabricated thread history with fake VIP recipients severity high
VIP impersonation: VIP name within a delimited subject with fake previous threads severity high
VIP local_part impersonation from unsolicited sender severity high
X (Twitter) impersonation with credential phishing motives severity medium
Xero infrastructure abuse severity medium
Xero invoice abuse severity medium

sender.email

763 detection rules reference this catalog entry. View catalog entry.

Sublime MQL (763)

Abuse: Robinhood injected content severity medium
Advance Fee Fraud (AFF) from freemail provider or suspicious TLD severity medium
AnonymousFox indicators severity high
Attachment: Adobe image lure in body or attachment with suspicious link severity medium
Attachment: Any .sap file (unsolicited) severity low
Attachment: Any HTML file (unsolicited) severity low
Attachment: Any HTML file (untrusted sender) severity medium
Attachment: Calendar invite with suspicious link leading to an open redirect severity high
Attachment: Callback phishing solicitation via image file severity high
Attachment: Callback phishing solicitation via pdf file severity high
Attachment: Callback phishing solicitation via text-based file severity medium
Attachment: Compensation review lure with QR code severity high
Attachment: Compensation-themed DOCX with QR code credential theft severity high
Attachment: DocuSign impersonation via PDF linking to new domain severity medium
Attachment: EML containing a base64 encoded script severity high
Attachment: EML file contains HTML attachment with login portal indicators severity high
Attachment: EML file with HTML attachment (unsolicited) severity medium
Attachment: EML with link to credential phishing page severity high
Attachment: EML with Sharepoint link likely unrelated to sender severity medium
Attachment: EML with suspicious indicators severity medium
Attachment: Encrypted PDF with credential theft body severity medium
Attachment: Encrypted PDF with credential theft language in EML severity medium
Attachment: Fake attachment image lure severity medium
Attachment: Fake scan-to-email severity medium
Attachment: Fake secure message and suspicious indicators severity medium
Attachment: Fake voicemail via PDF severity medium
Attachment: HTML attachment with login portal indicators severity medium
Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts severity high
Attachment: HTML smuggling - QR Code with suspicious links severity high
Attachment: HTML smuggling Microsoft sign in severity high
Attachment: HTML smuggling with atob and high entropy severity high
Attachment: HTML smuggling with atob and high entropy via calendar invite severity high
Attachment: HTML smuggling with decimal encoding severity high
Attachment: HTML with emoji-to-character map severity high
Attachment: HTML with hidden body severity high
Attachment: HTML with JavaScript functions for HTTP requests severity high
Attachment: ICS calendar invite with bid/RFP lure and suspicious link severity medium
Attachment: ICS calendar invite with financial lure and suspicious link severity medium
Attachment: ICS calendar with embedded file from internal sender with SPF failure severity high
Attachment: ICS file with credential theft indicators severity medium
Attachment: ICS invite meeting lure severity medium
Attachment: ICS voicemail lure with suspicious link severity medium
Attachment: Image-only docx/pptx callback phishing severity medium
Attachment: Invoice and W-9 PDFs with suspicious creators severity high
Attachment: Microsoft 365 credential phishing severity high
Attachment: Microsoft impersonation via PDF with link and suspicious language severity high
Attachment: PDF bid/proposal lure with credential theft indicators severity medium
Attachment: PDF file with link to fake Bitcoin exchange severity low
Attachment: PDF proposal with credential theft indicators severity high
Attachment: PDF with credential theft language and invalid reply-to domain severity medium
Attachment: PDF with localhost IP in EXIF title metadata severity medium
Attachment: PDF with Microsoft Purview message impersonation severity medium
Attachment: PDF with personal Microsoft OneNote URL severity medium
Attachment: PDF with self-service platform links with self sender or blank recipients severity medium
Attachment: PDF with suspicious HeadlessChrome metadata severity medium
Attachment: PDF with View RFP Document lure with external link severity high
Attachment: QR code with credential phishing indicators severity medium
Attachment: QR code with userinfo portion severity high
Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender severity medium
Attachment: RFP/RFQ impersonating government entities severity high
Attachment: Risk assessment PDF with inline image severity high
Attachment: Romance scam with image lure and advance-fee or suspicious link indicators severity medium
Attachment: Self-sender PDF with minimal content and view prompt severity high
Attachment: Suspicious employee policy update document lure severity medium
Attachment: USDA bid invitation impersonation severity medium
Attachment: Zip exploiting CVE-2023-38831 (unsolicited) severity critical
BEC with unusual reply-to or return-path mismatch severity high
BEC/Fraud: Fake investment outreach from suspicious TLD severity medium
BEC/Fraud: Generic scam attempt to undisclosed recipients severity low
BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
BEC/Fraud: Penpal scam severity medium
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply severity medium
BEC/Fraud: Romance scam severity medium
BEC/Fraud: Scam lure with freemail pivot severity low
BEC/Fraud: Self-addressed reply with unrelated link in ongoing thread severity medium
BEC/Fraud: Student loan callback phishing severity medium
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns severity medium
BEC: Financial fraud from newly registered sender domain severity medium
BEC: Tax document request severity medium
Benefits enrollment impersonation severity high
Body HTML: Comment with 24-character hex token severity low
Body HTML: Recipient SLD in HTML class severity medium
Body: AI-generated invoice template artifacts severity medium
Body: Embedded email headers indicative of thread hijacking/abuse severity medium
Body: HTML whitespace stuffing with short initial message severity medium
Brand impersonation: AARP severity medium
Brand impersonation: Adobe (QR code) severity high
Brand impersonation: Adobe Sign with suspicious indicators severity high
Brand impersonation: Adobe with suspicious language and link severity high
Brand impersonation: ADP severity medium
Brand impersonation: AliExpress severity medium
Brand impersonation: Amazon severity low
Brand impersonation: Amazon Web Services (AWS) severity medium
Brand impersonation: Amazon with suspicious attachment severity medium
Brand impersonation: American Express (AMEX) severity low
Brand impersonation: Anthropic/Claude with newly registered domain severity medium
Brand impersonation: Apple severity high
Brand impersonation: Aquent severity medium
Brand impersonation: Aramco severity medium
Brand impersonation: AuthentiSign severity medium
Brand impersonation: Automobile assistance associations severity high
Brand impersonation: Bank of America severity high
Brand impersonation: Barracuda Networks severity medium
Brand impersonation: Bids & Tenders severity high
Brand impersonation: Binance severity medium
Brand impersonation: Blockchain.com severity medium
Brand impersonation: Booking.com severity medium
Brand impersonation: Box file sharing service severity medium
Brand impersonation: Canada Revenue Agency severity medium
Brand impersonation: Capital One severity high
Brand impersonation: Charles Schwab severity medium
Brand impersonation: Chase Bank severity high
Brand impersonation: Chase bank with credential phishing indicators severity medium
Brand impersonation: Cloud services with credential theft intent severity medium
Brand impersonation: Coinbase severity high
Brand impersonation: Coinbase with suspicious links severity medium
Brand impersonation: Dashlane severity medium
Brand impersonation: DHL severity low
Brand impersonation: DigitalOcean severity high
Brand impersonation: Discord notification severity medium
Brand Impersonation: Disney severity medium
Brand impersonation: DocSend severity high
Brand impersonation: DocuSign severity high
Brand impersonation: DocuSign (QR code) severity high
Brand impersonation: DocuSign with embedded QR code severity high
Brand impersonation: DoorDash severity medium
Brand impersonation: Dotloop severity medium
Brand impersonation: Dropbox severity medium
Brand impersonation: Enbridge severity medium
Brand impersonation: Evite severity medium
Brand impersonation: Exodus severity low
Brand impersonation: Fake DocuSign HTML table not linking to DocuSign domains severity medium
Brand impersonation: Fake Fax severity medium
Brand impersonation: Fastway severity medium
Brand impersonation: FedEx severity low
Brand impersonation: Figma with malicious document access overlay severity high
Brand impersonation: File sharing notification with template artifacts severity low
Brand impersonation: FINRA severity medium
Brand Impersonation: Gemini Trust Company severity medium
Brand impersonation: Github severity high
Brand impersonation: GitHub with callback scam indicators severity medium
Brand impersonation: GoDaddy severity medium
Brand Impersonation: Google (QR Code) severity high
Brand impersonation: Google Careers severity high
Brand impersonation: Google Drive fake file share severity medium
Brand impersonation: Google fake sign-in warning severity high
Brand impersonation: Google using Microsoft Forms severity high
Brand impersonation: Google Workspace alert notification severity medium
Brand impersonation: Government / Tax Authority document lure severity medium
Brand impersonation: Greenvelope severity medium
Brand impersonation: Greetings Island severity high
Brand impersonation: Gusto severity medium
Brand impersonation: Hulu severity medium
Brand impersonation: Interac severity medium
Brand impersonation: Internal Revenue Service severity high
Brand impersonation: KnowBe4 severity medium
Brand impersonation: LastPass severity high
Brand impersonation: Ledger severity low
Brand impersonation: LinkedIn severity medium
Brand impersonation: Mailchimp severity medium
Brand impersonation: Mailgun severity medium
Brand impersonation: Marriott with gift language severity medium
Brand impersonation: McAfee severity medium
Brand impersonation: Meta and subsidiaries severity medium
Brand impersonation: MetaMask severity high
Brand impersonation: Microsoft severity high
Brand impersonation: Microsoft (QR code) severity high
Brand impersonation: Microsoft fake sign-in alert severity medium
Brand impersonation: Microsoft logo in HTML with fake quarantine release notification severity high
Brand impersonation: Microsoft logo or suspicious language with open redirect severity high
Brand impersonation: Microsoft Planner with suspicious link severity medium
Brand impersonation: Microsoft quarantine release notification in body severity high
Brand impersonation: Microsoft quarantine release notification in image attachment severity high
Brand impersonation: Microsoft Teams severity high
Brand impersonation: Microsoft Teams invitation severity high
Brand impersonation: Microsoft with embedded logo and credential theft language severity high
Brand impersonation: Microsoft with low reputation links severity medium
Brand impersonation: Morgan Stanley severity medium
Brand impersonation: MyChart severity medium
Brand impersonation: Navan severity medium
Brand impersonation: Netflix severity low
Brand impersonation: Norton severity low
Brand impersonation: Office 365 mail service severity medium
Brand impersonation: Okta severity medium
Brand Impersonation: OpenAI with ChatGPT Ads lure severity high
Brand impersonation: OpenAI with payment issues severity high
Brand impersonation: Outlook severity high
Brand impersonation: Paperless Post severity high
Brand Impersonation: PayPal severity medium
Brand impersonation: PNC severity medium
Brand Impersonation: Procore severity medium
Brand impersonation: Proofpoint secure messaging without legitimate indicators severity high
Brand impersonation: Punchbowl severity medium
Brand impersonation: Purdue ePlanroom with suspicious links severity medium
Brand impersonation: QuickBooks severity medium
Brand impersonation: QuickBooks dispute notification severity high
Brand impersonation: QuickBooks notification from Intuit themed company name severity medium
Brand impersonation: Ripple severity low
Brand impersonation: Robert Half severity medium
Brand impersonation: Robinhood severity medium
Brand impersonation: Sedgwick Claims severity medium
Brand impersonation: SendGrid severity medium
Brand Impersonation: ShareFile severity medium
Brand impersonation: Sharepoint severity high
Brand impersonation: Sharepoint fake file share severity medium
Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
Brand Impersonation: Shein severity medium
Brand impersonation: Silicon Valley Bank severity medium
Brand impersonation: SiriusXM severity medium
Brand impersonation: Social Security Administration severity medium
Brand impersonation: SoFi severity medium
Brand impersonation: Spotify severity low
Brand impersonation: Square severity medium
Brand impersonation: Squarespace severity medium
Brand impersonation: State Farm severity medium
Brand impersonation: Stellar Development Foundation (SDF) severity low
Brand Impersonation: Stripe severity high
Brand impersonation: Stripe notification severity medium
Brand impersonation: Sublime Security severity high
Brand impersonation: Survey request with credential theft indicators severity medium
Brand impersonation: TikTok severity medium
Brand impersonation: Toronto-Dominion Bank severity medium
Brand impersonation: Trust Wallet severity high
Brand impersonation: TurboTax severity low
Brand impersonation: Twitter severity medium
Brand impersonation: UK government Home Office severity high
Brand impersonation: ukr[.]net severity medium
Brand impersonation: United Healthcare severity medium
Brand impersonation: United States Patent and Trademark Office severity medium
Brand impersonation: UPS severity low
Brand impersonation: USPS severity high
Brand impersonation: Vanguard severity medium
Brand impersonation: Vanta severity low
Brand impersonation: Venmo severity medium
Brand impersonation: Wells Fargo severity high
Brand impersonation: WeTransfer severity high
Brand impersonation: Wise severity high
Brand impersonation: Wix severity medium
Brand impersonation: Xodo Sign severity medium
Brand impersonation: Zoom severity medium
Brand impersonation: Zoom (strict) severity medium
Brand impersonation: Zoom via lookalike domain severity high
Brand impersonation: Zoom with deceptive link display severity medium
Brand spoof: Dropbox severity medium
Business Email Compromise (BEC) attempt from unsolicited sender severity medium
Business Email Compromise (BEC) attempt from untrusted sender severity medium
Business Email Compromise (BEC) attempt from untrusted sender (French/Français) severity medium
Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited) severity medium
Business Email Compromise: Request for mobile number via reply thread hijacking severity medium
Callback phishing in body or attachment (untrusted sender) severity medium
Callback phishing solicitation in message body severity medium
Callback phishing via Adobe Sign comment severity high
Callback phishing via Apple ID display name abuse severity high
Callback phishing via calendar invite severity medium
Callback phishing via DocuSign comment severity high
Callback phishing via extensionless rfc822 attachment severity high
Callback phishing via Google Group abuse severity high
Callback phishing via Intuit service abuse severity medium
Callback phishing via Microsoft comment severity medium
Callback Phishing via Signable E-Signature Request severity high
Callback phishing via SignFree e-signature request severity high
Callback phishing via Xodo Sign comment severity high
Callback phishing via Yammer comment severity medium
Callback phishing via Zelle Service Abuse severity medium
Callback phishing via Zoho service abuse severity medium
Callback Phishing via Zoom comment severity medium
Callback phishing: AOL senders with suspicious HTML template or PDF attachment severity high
Callback phishing: Branded invoice from sender/reply-to domain less than 30 days old severity medium
Callback phishing: Social Security Administration fraud severity medium
Callback phishing: SumUp infrastructure abuse severity high
Callback phishing: Zero-width character obfuscation from freemail sender severity medium
Callback scam: Impersonation via TimeTrade infrastructure severity medium
Canva infrastructure abuse severity medium
Catbox.moe link from untrusted source severity medium
ClickFix: Clipboard hijack lure with copy-paste-to-terminal instruction severity high
ClickFunnels link infrastructure abuse severity high
Cloud storage impersonation with credential theft indicators severity medium
Commonly abused sender TLD with engaging language severity medium
Compensation review with QR code in attached EML severity high
Constant Contact link infrastructure abuse severity high
COVID-19 themed fraud with sender and reply-to mismatch or compensation award severity medium
Credential phishing content and link (untrusted sender) severity high
Credential phishing language and suspicious indicators (unknown sender) severity medium
Credential phishing link (unknown sender) severity high
Credential Phishing via Dropbox comment abuse severity medium
Credential phishing: 'Secure message' and engaging language severity medium
Credential phishing: AWS Lambda URL with recipient targeting severity medium
Credential Phishing: Bitcoin portfolio confirmation severity medium
Credential phishing: Blue button styled link with file-sharing template artifacts severity low
Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
Credential phishing: Email delivery failure impersonation severity high
Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
Credential phishing: Fake card notification with tracking lure severity medium
Credential phishing: Fake password expiration from new and unsolicited sender severity medium
Credential phishing: Fake storage alerts (unsolicited) severity medium
Credential phishing: Financial lure via ActiveCampaign infrastructure severity medium
Credential phishing: Generic document share with unicode and proceedural greeting template severity low
Credential phishing: Generic document sharing severity medium
Credential phishing: Hyper-linked image leading to free file host severity medium
Credential phishing: Image as content, short or no body contents severity medium
Credential phishing: Onedrive impersonation severity high
Credential phishing: Re-Authentication lure severity high
Credential phishing: Suspicious e-sign agreement document notification severity medium
Credential phishing: Suspicious subject with urgent financial request and link severity medium
Credential phishing: Tax form impersonation with payment request severity medium
Cyrillic vowel substitution in subject or display name from unknown sender severity medium
Deceptive Dropbox mention severity medium
Display name and subject impersonation using recipient SLD (new sender) severity medium
Display Name Emoji with Financial Symbols severity low
Display name impersonation using recipient SLD severity medium
Disposable sender email (unsolicited) severity low
DocuSign impersonation via CloudHQ links severity medium
DocuSign impersonation via spoofed Intuit sender severity high
Domain impersonation: Freemail reply-to local lookalike with financial request severity medium
EML attachment with credential theft language (unknown sender) severity high
Employee impersonation with urgent request (untrusted sender) severity medium
Employee impersonation: Payroll fraud severity high
Encrypted Microsoft Office files from untrusted sender severity medium
Evasion: Hidden content divs from freemail sender severity medium
Extortion / sextortion (untrusted sender) severity low
Extortion / Sextortion - PDF attachment leveraging breach data from freemail sender severity high
Extortion / sextortion in attachment from untrusted sender severity low
Fake email quarantine notification severity high
Fake message thread - Untrusted sender with a mismatched freemail reply-to address severity medium
Fake message thread with a suspicious link and engaging language from an unknown sender severity medium
Fake request for tax preparation severity high
Fake scan-to-email message severity medium
Fake shipping notification with link to free file hosting severity low
Fake thread with suspicious indicators severity medium
Fake voicemail notification (untrusted sender) severity medium
Fake Zoom meeting invite with suspicious link severity medium
File sharing link from suspicious sender domain severity medium
File sharing link with a suspicious subject severity medium
Fraudulent e-commerce operators severity high
Fraudulent order confirmation/shipping notification from Chinese sender domain severity medium
Free email provider sender with mismatched provider reply-to severity medium
Free subdomain link with credential theft indicators severity high
Free subdomain link with login or captcha (untrusted sender) severity medium
Generic service abuse from newly registered domain severity high
Google Drive abuse: Credential phishing link severity high
Google Drive direct download link from unsolicited sender severity medium
Google Notification alert link from non-Google sender severity medium
Google presentation open redirect phishing severity medium
Google services using g.co shortlinks severity medium
Google share notification with suspicious comments severity high
Hardbacon infrastructure abuse severity high
Headers: Fake in-reply-to with wildcard sender and missing thread context severity high
Headers: Invalid recipient domain with mismatched reply-to from new sender severity medium
Headers: Self-sender using Microsoft CompAuth bypass with credential theft content severity high
Headers: System account impersonation with empty sender address severity medium
Headers: X-Source-Auth mismatch with mismatched reply-to domain severity high
Honorific greeting BEC attempt with sender and reply-to mismatch severity low
HR impersonation via e-sign agreement comment severity high
HTML smuggling containing recipient email address severity medium
Image as content with a link to an open redirect severity high
Impersonation using recipient domain (untrusted sender) severity medium
Impersonation: Chrome Web Store policy severity low
Impersonation: Employee name in subject with suspicious sender severity medium
Impersonation: Employee using fabricated identity in initial contact severity high
Impersonation: Executive using numbered local part severity high
Impersonation: Fake Gmail attachment severity high
Impersonation: Fake product discount promotion severity medium
Impersonation: Human Resources with link or attachment and engaging language severity medium
Impersonation: Internal corporate services severity high
Impersonation: Legal firm with copyright infringement notice severity medium
Impersonation: Salesforce fake campaign failure notification severity medium
Impersonation: SAM/SBA federal registration severity high
Impersonation: SharePoint reply header anomaly severity medium
Impersonation: Suspected supplier impersonation with suspicious content severity high
Inbound message from popular service via newly observed distribution list severity medium
Investor solicitation with organization targeting severity medium
Invoicera infrastructure abuse severity medium
Job scam (unsolicited sender) severity low
Job scam with specific salary pattern severity low
Link abuse: Self-service creation platform link with suspicious recipient behavior severity high
Link to auto-downloaded DMG in archive severity medium
Link to auto-downloaded DMG in encrypted zip severity high
Link: .onion From Unsolicited Sender severity low
Link: Adobe share from unsolicited sender severity medium
Link: Adobe share with suspicious indicators severity high
Link: Apple App Store malicious ad manager themed apps from free email provider severity medium
Link: Apple TestFlight from suspicious sender severity medium
Link: BEC with newly registered domains and financial keywords severity medium
Link: Common hidden directory observed severity medium
Link: Credential harvesting with excess padding evasion severity low
Link: Credential phishing link with undisclosed recipients severity medium
Link: Credential phishing traversing Russian infrastructure severity high
Link: Credential phishing via WordPress severity high
Link: Cryptocurrency fraud with suspicious links severity high
Link: Direct download of executable file severity low
Link: Direct link to limewire hosted file severity high
Link: Direct link to riddle.com hosted showcase severity medium
Link: Direct link to Zoom Docs from non-Zoom sender severity medium
Link: Direct MSI download from low reputation domain severity low
Link: Direct POWR.io Form Builder with suspicious patterns severity medium
Link: Display text matches subject line severity medium
Link: Double base64-encoded URL path severity medium
Link: Executable file download with suspicious message content severity high
Link: Fake RFP/bid reference number lure severity medium
Link: Fake video link from newly registered domain severity medium
Link: File sharing impersonation with suspicious language and sending patterns severity medium
Link: Financial account issue with suspicious indicators severity medium
Link: Flagged bit.ly link severity medium
Link: Fraudulent state business filing notice severity medium
Link: Free file host links from suspicious support sender with credential theft language severity medium
Link: Free file hosting with undisclosed recipients severity medium
Link: Generic financial document with proceedural timeline template severity medium
Link: Gmail phishkit with suspicious recipient severity high
Link: Google Calendar invite linking to an open redirect from an untrusted freemail sender severity high
Link: GoPhish query param values severity low
Link: Hotel booking spoofed display URL severity medium
Link: Intuit link abuse with file share context severity medium
Link: Invoice or receipt from freemail sender with customer service number severity low
Link: IPFS severity medium
Link: Jensi file preview link from unsolicited sender severity medium
Link: Job recruitment lure from unsolicited sender with suspicious hosting severity medium
Link: Mamba 2FA phishing kit severity high
Link: Microsoft Dynamics 365 form phishing severity high
Link: Microsoft impersonation using hosted png with suspicious link severity medium
Link: Microsoft protected message with suspicious recipient patterns severity medium
Link: Mismatched free file host links with document lure severity medium
Link: Mismatched Shopify template button href severity medium
Link: Multiple HTTP protocols in single URL severity medium
Link: Multistage landing - Abused Adobe frame.io severity high
Link: Multistage landing - Abused Docusign severity high
Link: Multistage landing - Abused Google Drive severity high
Link: Multistage landing - FreshDesk knowledge base abuse severity high
Link: Multistage landing - Ludus presentation severity medium
Link: Multistage landing - Microsoft Forms abuse severity high
Link: Multistage landing - Published Google Doc severity high
Link: Multistage landing - Scribd document severity medium
Link: MyActiveCampaign Link Abuse severity medium
Link: Non-standard port 8443 in display URL severity medium
Link: Observed URL pattern with specific domain registrar severity high
Link: PDF filename impersonation with credential theft language severity medium
Link: Personalized URL with recipient address on commonly abused web service severity medium
Link: QR code with phishing disposition in img or pdf severity high
Link: QR Code with suspicious language (untrusted sender) severity medium
Link: QuickBooks image lure with suspicious link severity medium
Link: Recipient domain in URL path severity high
Link: Referrer anonymization service from untrusted sender severity medium
Link: Romance/Sexual Language With Suspicious Link severity low
Link: ScreenConnect installer with suspicious relay domain severity high
Link: Secure SharePoint file share from new or unusual sender severity low
Link: Self-sender credential theft with configuration placeholder severity high
Link: Self-sender with IP geolocation check and suspicious link behavior severity medium
Link: Self-sender with sender org in subject and credential theft indicator severity high
Link: Self-sent message with quarterly document review request severity critical
Link: Self-sent PDF lure with subject correlation severity medium
Link: SharePoint filename matches org name severity medium
Link: SharePoint OneNote or PDF link with self sender behavior severity medium
Link: Single character path with credential theft body and self sender behavior or invalid recipient severity medium
Link: Spam website with evasion indicators severity low
Link: Suspicious recipient with timeout redirect severity medium
Link: Suspicious SharePoint document name severity low
Link: Suspicious Sharepoint folder share severity high
Link: Suspicious wp-admin path from mismatched sender domain severity medium
Link: Tax document lure Portuguese/Spanish with suspicious domains severity medium
Link: URL shortener with copy-paste instructions and credential theft language severity low
Link: Webflow link from unsolicited sender severity medium
Link: Zoho form link from unsolicited sender severity medium
Lookalike sender domain (untrusted sender) severity high
macOS malware: Compiled AppleScript with document double-extension severity high
Malware: Pikabot delivery via URL auto-download severity high
Mass campaign: Cross Site Scripting (XSS) attempt severity medium
Mass campaign: recipient address in subject, body, and link (untrusted sender) severity medium
Message content: Request for author engagement severity low
Microsoft device code phishing severity medium
Microsoft infrastructure abuse with suspicious patterns severity high
New sender domain (<=10d) from untrusted sender severity medium
Newly registered sender or reply-to domain with newly registered linked domain severity medium
Notion suspicious file share severity medium
Observed IOC: Malicious sender domains severity high
Observed IOC: Malicious sender email addresses severity high
Observed IOC: Malicious sender root domains severity high
Open redirect: adnxs.com severity medium
Open redirect: agena-smile.com severity medium
Open redirect: amaterasu-for-website-5.com severity medium
Open redirect: api.spently.com severity medium
Open redirect: Artisteer severity medium
Open redirect: artkaderne severity medium
Open Redirect: asemailmgmteu.com severity medium
Open redirect: astroarts.co.jp severity medium
Open redirect: Avast severity medium
Open redirect: bananaguide.com severity medium
Open redirect: bangkoksync.com severity medium
Open redirect: bestdeals.today severity medium
Open redirect: Bitrix24 URL Path severity medium
Open redirect: BMW USA severity medium
Open redirect: bubblelife.com severity medium
Open redirect: buildingengines.com severity medium
Open redirect: business.google.com website_shared URL Param severity medium
Open redirect: chkc.com.hk severity medium
Open redirect: City of Calgary severity medium
Open redirect: Club-OS severity medium
Open redirect: convertcart.com severity medium
Open redirect: Dell severity medium
Open redirect: designsori.com severity medium
Open redirect: Diesel.az severity medium
Open redirect: documentmailbox.com severity medium
Open redirect: eaoko.org severity medium
Open redirect: easycamp.com severity medium
Open redirect: embluemail.com severity medium
Open redirect: emlakarsa severity medium
Open redirect: emp.eduyield.com severity medium
Open redirect: eodcnetworkdirect.com severity medium
Open redirect: events.csiro.au severity medium
Open redirect: ExacTag severity medium
Open redirect: fenc.com severity medium
Open redirect: g7.fr severity medium
Open redirect: giving.lluh.org severity medium
Open redirect: Google Ad Services severity medium
Open Redirect: Google domain with /url path and suspicious indicators severity medium
Open redirect: ijf.org severity medium
Open redirect: Indeed severity medium
Open redirect: IndiaTimes severity medium
Open redirect: isadatalab.com severity medium
Open redirect: JustPaste.it severity medium
Open redirect: k-mil.net severity medium
Open redirect: labcluster.com severity medium
Open redirect: LearningApps severity medium
Open redirect: Linkedin severity medium
Open redirect: LinkedIn Redirect severity medium
Open redirect: listing.ca severity medium
Open redirect: magic4media.com severity medium
Open redirect: magiccity.ne.jp severity medium
Open redirect: magneticmarketing.com severity medium
Open redirect: mail.spiceworks.com severity medium
Open redirect: marketing.edinburghairport.com severity medium
Open redirect: McGill University severity low
Open redirect: Medium severity medium
Open redirect: mindmixer.com severity medium
Open redirect: museepicassoparis.fr severity medium
Open redirect: Newegg severity medium
Open redirect: next2.io severity medium
Open redirect: nowlifestyle.com severity medium
Open redirect: obunsha.co.jp severity medium
Open redirect: Panera Bread severity medium
Open redirect: people.anuneo.com severity medium
Open redirect: phoenixartstudio.net severity medium
Open redirect: PIRL San Diego severity medium
Open redirect: plasticsurgery.or.kr severity medium
Open redirect: pmifunds.com severity medium
Open redirect: predictiveresponse.net severity medium
Open redirect: PremierBet severity medium
Open redirect: qrxtech.com severity medium
Open redirect: queue.swytchbike.com severity medium
Open redirect: radiopublic.com severity medium
Open redirect: retailrocket.net severity medium
Open redirect: ringaraja.net severity medium
Open redirect: Samsung severity medium
Open redirect: sciencebuddies.org severity medium
Open redirect: secondstreetapp.com severity medium
Open redirect: shoppermeet.net severity medium
Open redirect: shoppingwebapi.didatravel.com severity medium
Open redirect: Signature Travel Network severity medium
Open redirect: Slack severity low
Open redirect: slubnaglowie.pl severity medium
Open redirect: smartadserver.com severity medium
Open redirect: smore.com severity medium
Open redirect: Snapchat severity medium
Open redirect: social.bigpress.net severity medium
Open redirect: ssg-financial.com severity medium
Open redirect: stats.lib.pdx.edu severity medium
Open redirect: storematch.jp severity medium
Open redirect: Ticketmaster severity low
Open redirect: TikTok severity medium
Open redirect: tkqlhce.com severity medium
Open redirect: tuttocauzioni.it severity medium
Open redirect: typedrawers.com severity medium
Open redirect: unitedwaynwvt.org severity medium
Open redirect: ust.hk severity medium
Open redirect: vconfex.com severity medium
Open redirect: VK severity medium
Open redirect: weblinkconnect.com severity medium
Open redirect: whitefox.pl severity medium
Open redirect: Xfinity CMP Redirection to Google AMP severity medium
Open redirect: xfinity.com severity medium
Open redirect: YouTube severity medium
PayPal invoice abuse severity medium
Potential prompt injection attack in body HTML severity high
Punycode sender domain severity high
QR code to auto-download of a suspicious file type (unsolicited) severity high
QR Code with suspicious indicators severity high
Reconnaissance: All recipients cc/bcc'd or undisclosed severity low
Reconnaissance: Email address harvesting attempt severity medium
Reconnaissance: Empty subject with mismatched reply-to from new sender severity medium
Reconnaissance: Hotel booking reply-to redirect severity medium
Reconnaissance: Large unknown recipient list severity low
Reconnaissance: Short generic greeting message severity medium
Recruitee Infrastructure Abuse severity high
Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
Russia return-path TLD (untrusted sender) severity low
Salesforce infrastructure abuse severity medium
Scam soliciting employer review/rating severity low
Scam: Fake estate sale offering welding equipment and tools severity high
Scam: Piano giveaway severity medium
Self-impersonation: Sender matches recipient with bolded name and suspicious link severity medium
Self-sender with copy/paste instructions and suspicious domains (French/Français) severity medium
Self-sent fake PDF attachment with misleading link severity low
Sender name contains Active Directory distinguished name severity medium
Sender: IP address in local part severity medium
Sender: Local part built from recipient domain and mailbox severity low
Sendgrid onmicrosoft.com domain phishing severity medium
Service abuse: Adobe Creative Cloud share from an unsolicited sender address severity low
Service abuse: Adobe message from newly registered domain severity medium
Service abuse: Adobe share containing newly observed email address domain severity high
Service abuse: Adobe Sign notification from an unsolicited reply-to address severity medium
Service abuse: Amazon invitation with suspected callback phishing severity medium
Service abuse: Apple TestFlight with suspicious developer reference severity high
Service abuse: AppSheet infrastructure with suspicious indicators severity medium
Service abuse: Arketa notification callback scam severity medium
Service abuse: AWS SNS callback scam impersonation severity medium
Service abuse: Behance document sharing with suspicious language severity medium
Service Abuse: Box file sharing with credential phishing intent severity medium
Service abuse: Calendly callback scam detection severity medium
Service abuse: Callback phishing via Microsoft Teams invite severity high
Service abuse: Cisco secure email service with financial request severity high
Service abuse: Cognito Forms with short body from unknown sender severity medium
Service abuse: Coursera callback scam severity high
Service abuse: Demio notifications with suspicious content patterns severity medium
Service abuse: DocSend share from an unsolicited reply-to address severity high
Service abuse: DocSend share from newly registered domain severity high
Service abuse: DocuSign notification with suspicious sender or document name severity medium
Service abuse: DocuSign share from an unsolicited reply-to address severity medium
Service abuse: Domains By Proxy sender severity medium
Service abuse: Dropbox share from an unsolicited reply-to address severity medium
Service abuse: Dropbox share from new domain severity medium
Service abuse: Dropbox share with suspicious sender or document name severity medium
Service abuse: Elastic alerts extortion severity medium
Service abuse: Evernote link severity low
Service Abuse: ExactTarget with suspicious sender indicators severity high
Service abuse: Facebook business with action required subject severity medium
Service abuse: Facebook mail notification callback scam severity medium
Service abuse: Fake loan/funding verification lure via Mailgun severity medium
Service abuse: FileMail callback scam severity medium
Service abuse: Free provider with SendGrid routing severity medium
Service abuse: GetAccept callback scam content severity medium
Service abuse: GitHub notification with excessive mentions and suspicious links severity high
Service Abuse: GoDaddy infrastructure severity medium
Service abuse: Google account notification with links to free file host severity high
Service abuse: Google application integration redirecting to suspicious hosts severity medium
Service abuse: Google Calendar notification with callback scam language severity medium
Service abuse: Google classroom solicitation severity medium
Service abuse: Google Drive share from an unsolicited reply-to address severity medium
Service abuse: Google Drive share from new reply-to domain severity medium
Service abuse: Google Firebase sender address with suspicious content severity low
Service abuse: Google Groups callback scam severity medium
Service abuse: HelloSign from an unsolicited sender address severity low
Service Abuse: HelloSign share with suspicious sender or document name severity medium
Service abuse: HungerRush domain with SendGrid tracking targeting ProtonMail severity high
Service abuse: IBM IAM account notification with callback scam indicators severity medium
Service abuse: Meetup.com redirect with brand impersonation severity medium
Service abuse: Microsoft Forms Pro with suspicious links or QR codes severity medium
Service abuse: Microsoft Power Apps callback scam severity medium
Service abuse: Microsoft Power Automate callback scam impersonation severity medium
Service abuse: Microsoft Power BI callback scam severity medium
Service abuse: Microsoft with suspicious indicators in subject severity medium
Service abuse: Monday.com callback scam severity medium
Service abuse: Monday.com infrastructure with phishing intent severity high
Service abuse: MongoDB Atlas callback scam severity medium
Service Abuse: Nifty.com with impersonation severity medium
Service abuse: Notion free-tier account impersonating VIP severity medium
Service abuse: Oracle Cloud Workflow callback scam severity medium
Service abuse: Payoneer callback scam severity medium
Service abuse: PayPal manager account creation with callback scam indicators severity medium
Service abuse: Postman reply-to mismatch with credential theft intent severity medium
Service abuse: QuickBooks notification from new domain severity medium
Service abuse: QuickBooks notification with suspicious comments severity medium
Service abuse: Recruiting with suspicious language patterns from legitimate platforms severity medium
Service abuse: Roomsy with unrelated body content severity medium
Service abuse: SendGrid impersonation via Sendgrid from new sender severity high
Service abuse: SendThisFile with credential theft and financial language severity medium
Service abuse: Settime.io sender with callback scam intent severity medium
Service abuse: Square marketing with suspicious QR code severity high
Service abuse: Substack credential theft with confusable characters and branded button redirects severity medium
Service abuse: SurveyMonkey survey from newly registered domain severity high
Service abuse: SurveyMonkey with suspicious outbound links severity medium
Service abuse: Suspicious Datadog alert severity high
Service abuse: Suspicious Zoom Docs link severity low
Service abuse: Task management message sent via SendGrid severity medium
Service abuse: Trello board invitation with VIP impersonation severity medium
Service abuse: Vimeo with external plain-text links in message severity high
Service abuse: WeTransfer callback scam severity medium
Service abuse: Wufoo credential theft severity medium
Service abuse: Zohodesk reply-to mismatch with job scam indicators severity medium
Service abuse: Zoom Clips with suspicious reply-to address or links severity low
Service Abuse: Zoom with freemail reply-to and recipient address in greeting severity medium
Service abuse: Zoom with newly registered reply-to domain severity medium
Sharepoint link likely unrelated to sender severity medium
Sharepoint online with external recipients and external display name severity medium
SharePoint OTP for filename matching org name severity medium
Spam/fraud: Predatory journal/research paper request severity medium
Spam: Attendee list solicitation severity low
Spam: BlackBaud infrastructure abuse severity medium
Spam: Campaign with excessive space/char obfuscation and free file hosted link severity low
Spam: Cold outreach from Cloudflare-hosted newly registered domain severity low
Spam: Cryptocurrency airdrop/giveaway severity low
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
Spam: Fake dating profile notification severity low
Spam: Fake photo share severity low
Spam: Firebase password reset from suspicious sender severity low
Spam: Ghostwriting services scam with manipulative language severity medium
Spam: Item giveaway spam template severity low
Spam: Large financial amount mention from newly registered sender domain severity medium
Spam: Link to blob.core.windows.net from new domain (<30d) severity medium
Spam: Mastercard promotional content with image-based body severity low
Spam: New link domain (<=10d) and emojis severity medium
Spam: Sexually explicit content with emoji in subject from freemail provider severity low
Spam: Sexually explicit Google Drive share severity low
Spam: Sexually explicit Google group invitation severity low
Spam: Sexually explicit Looker Studio report severity low
Spam: Single recipient duplicated in cc severity medium
Spam: Spoofed Outlook mailer with unsubscribe and reference ID footer severity low
Spam: URL shortener with short body content and emojis severity low
Spamhaus: Mail transiting a DROP listed network severity medium
Spamhaus: Mail transiting an ASN-DROP listed network severity medium
Spoofable internal domain with suspicious signals severity medium
Stripe invoice abuse severity medium
Suspected cross-site scripting (XSS) found in subject severity medium
Suspected lookalike domain with suspicious language severity medium
Suspected WordPress abuse with cross-site scripting (XSS) indicators severity high
Suspicious attachment with unscannable Cloudflare link severity medium
Suspicious display name: Gmail sender with engaging language severity low
Suspicious DocuSign share from new domain severity high
Suspicious invoice reference with missing or image-only attachments severity high
Suspicious link to Looker Studio (lookerstudio.google.com) from a new and unsolicited sender severity medium
Suspicious Links to Cloudflare R2 and Edge Services severity medium
Suspicious message with unscannable Cloudflare link severity medium
Suspicious message with unscannable Vercel link severity medium
Suspicious newly registered reply-to domain with engaging financial or urgent language severity medium
Suspicious recipient pattern and language with low reputation link to login severity medium
Suspicious recipients pattern with no Compauth pass and suspicious content severity medium
Suspicious request for financial information severity high
Suspicious sender display name with long procedurally generated text blob severity medium
Suspicious SharePoint file sharing severity medium
Suspicious subject with long procedurally generated text blob severity medium
Tax Form: W-8BEN solicitation severity medium
Truth Social infrastructure abuse via link redirect severity medium
Twitter infrastructure abuse via link shortener severity medium
Unusually long local part from untrusted sender address severity low
Vendor compromise: GovDelivery message with suspicious link severity high
Vendor impersonation: Thread hijacking with typosquat domain severity high
Venmo payment request abuse severity medium
VIP / Executive impersonation (strict match, untrusted) severity high
VIP / Executive impersonation in subject (untrusted) severity medium
VIP Impersonation via Google Group relay with suspicious indicators severity high
VIP impersonation with BEC language (near match, untrusted sender) severity medium
VIP impersonation with invoicing request severity high
VIP impersonation with urgent request (strict match, untrusted sender) severity high
VIP impersonation with w2 request with reply-to mismatch severity high
VIP impersonation: Fabricated thread history with fake VIP recipients severity high
VIP impersonation: Fake thread with VIPs missing email metadata severity high
VIP impersonation: Invoice fraud with mobile device sign-off severity high
VIP impersonation: Payment handoff with VIP display name authored fake threads severity high
VIP Impersonation: VIP handoff with fake forwarded invoice thread severity high
VIP impersonation: VIP name within a delimited subject with fake previous threads severity high
VIP impersonation: VIP payment redirect handoff via fake threads severity high
VIP local_part impersonation from unsolicited sender severity high
X (Twitter) impersonation with credential phishing motives severity medium
Xero infrastructure abuse severity medium
Xero invoice abuse severity medium
Zoom Events newsletter abuse severity medium

Back to all Sublime-Message-sender catalog entries