Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security
Last updated Jul 25th, 2026
Feed Source
Detection Method is
Rule Name & Severity
Author
Last Updated
Labels
URL with Unicode U+2044 (⁄) or U+2215 (∕) characters
@delivr_to
6mo ago
Jan 12th, 2026
Vendor impersonation: Thread hijacking with typosquat domain
Sublime Security
6mo ago
Jan 12th, 2026
Venmo payment request abuse
Sublime Security
2mo ago
May 4th, 2026
VIP impersonation: Fabricated thread history with fake VIP recipients
Sublime Security
18d ago
Jul 8th, 2026
VIP impersonation: Fake forwarded indicator with VIP recipient impersonation
Sublime Security
19d ago
Jul 7th, 2026
VIP impersonation: Fake thread with display name match, email mismatch
Sublime Security
3mo ago
Apr 3rd, 2026
VIP impersonation: Fake thread with VIPs missing email metadata
Sublime Security
13d ago
Jul 13th, 2026
VIP impersonation: Invoice fraud with mobile device sign-off
Sublime Security
19d ago
Jul 7th, 2026
VIP impersonation: Payment handoff with VIP display name authored fake threads
Sublime Security
13d ago
Jul 13th, 2026
VIP Impersonation via Google Group relay with suspicious indicators
Sublime Security
1mo ago
Jun 5th, 2026
VIP impersonation: VIP name within a delimited subject with fake previous threads
Sublime Security
18d ago
Jul 8th, 2026
VIP impersonation: VIP payment redirect handoff via fake threads
Sublime Security
13d ago
Jul 13th, 2026
VIP impersonation: VIP recipient of previous thread with HTML generator
Sublime Security
19d ago
Jul 7th, 2026
VIP impersonation with BEC language (near match, untrusted sender)
Sublime Security
4mo ago
Mar 25th, 2026
VIP impersonation with charitable donation fraud
Sublime Security
1mo ago
Jun 5th, 2026
VIP impersonation with invoicing request
Sublime Security
2y ago
Apr 23rd, 2024
VIP impersonation with urgent request (strict match, untrusted sender)
Sublime Security
4mo ago
Mar 25th, 2026
VIP impersonation with w2 request with reply-to mismatch
Sublime Security
4mo ago
Mar 12th, 2026
Xero infrastructure abuse
Sublime Security
8mo ago
Nov 3rd, 2025
Xero invoice abuse
Sublime Security
7mo ago
Dec 17th, 2025