Sublime Core Feed

This repo contains open-source Rules for Sublime, a free and open platform for detecting and preventing email attacks like BEC, malware, and credential phishing.

Sublime Security

Last updated Sep 30th, 2026

Feed Source

GitHub

Detection Method is

Rule Name & Severity	Author	Last Updated	Labels
Service abuse: Coursera callback scam	Sublime Security	2mo ago Jul 21st, 2026	Callback Phishing Impersonation: Brand Lookalike domain Social engineering Sender analysis URL analysis Whois
Service abuse: EventCreate links to newly registered domains	Sublime Security	30d ago Aug 31st, 2026	Credential Phishing Out of band pivot URL analysis Whois HTML analysis
Service abuse: GitHub notification with excessive mentions and suspicious links	Sublime Security	5mo ago Apr 7th, 2026	Credential Phishing Malware/Ransomware Free file host Free subdomain host Social engineering Header analysis URL analysis Sender analysis Whois
Service abuse: Google Drive share from new reply-to domain	Sublime Security	10mo ago Nov 13th, 2025	BEC/Fraud Callback Phishing Credential Phishing Free email provider Social engineering Free file host Header analysis Sender analysis Whois
Service abuse: Google Firebase sender address with suspicious content	Sublime Security	3mo ago Jun 18th, 2026	Spam Credential Phishing Free subdomain host Social engineering Content analysis Header analysis HTML analysis Natural Language Understanding Sender analysis URL analysis Whois
Service abuse: Microsoft Forms Pro with suspicious links or QR codes	Sublime Security	2mo ago Jul 14th, 2026	Credential Phishing QR code Social engineering Impersonation: Brand URL analysis QR code analysis Sender analysis Whois Content analysis
Service abuse: Self-service platform redirecting to newly registered suspicious domain	Sublime Security	20d ago Sep 10th, 2026	Credential Phishing Out of band pivot Evasion URL analysis Whois HTML analysis
Service abuse: Zoom Clips with suspicious reply-to address or links	Sublime Security	29d ago Sep 1st, 2026	Spam Social engineering Evasion Sender analysis Header analysis Whois
Service abuse: Zoom with newly registered reply-to domain	Sublime Security	4mo ago May 4th, 2026	Spam Social engineering Evasion Sender analysis Header analysis Whois
Spam: Cold outreach from Cloudflare-hosted newly registered domain	Sublime Security	1mo ago Aug 17th, 2026	Spam Evasion Social engineering Whois Natural Language Understanding Content analysis
Spam: Fake photo share	Sublime Security	7d ago Sep 23rd, 2026	Spam Evasion Social engineering Content analysis Sender analysis URL analysis Whois
Spam/fraud: Predatory journal/research paper request	Sublime Security	11mo ago Nov 3rd, 2025	BEC/Fraud Spam Social engineering Impersonation: Brand Lookalike domain Evasion Natural Language Understanding Content analysis Sender analysis URL analysis Whois
Spam: Large financial amount mention from newly registered sender domain	Sublime Security	1mo ago Aug 3rd, 2026	BEC/Fraud Spam Social engineering Content analysis Sender analysis Whois
Spam: New link domain (<=10d) and emojis	Sublime Security	1y ago Jul 16th, 2025	Spam Free email provider Content analysis Sender analysis URL analysis Whois
Suspected lookalike domain with suspicious language	Sublime Security	8mo ago Jan 12th, 2026	BEC/Fraud Evasion Lookalike domain Social engineering Content analysis Natural Language Understanding Sender analysis Whois
Suspicious newly registered reply-to domain with engaging financial or urgent language	Sublime Security	7d ago Sep 23rd, 2026	BEC/Fraud Social engineering Content analysis Header analysis Natural Language Understanding Sender analysis URL analysis Whois
Vendor compromise: GovDelivery message with suspicious link	Sublime Security	1y ago Aug 5th, 2025	Credential Phishing Malware/Ransomware Free subdomain host IPFS Social engineering Evasion Impersonation: Brand Natural Language Understanding URL analysis Whois
Vendor impersonation: Thread hijacking with typosquat domain	Sublime Security	8mo ago Jan 12th, 2026	BEC/Fraud Lookalike domain Social engineering Spoofing Content analysis Natural Language Understanding Sender analysis Whois
VIP impersonation: Fake thread with display name match, email mismatch	Sublime Security	5mo ago Apr 3rd, 2026	BEC/Fraud Evasion Impersonation: VIP Social engineering Spoofing Content analysis Header analysis Sender analysis Whois

69 Rules

Page 2 of 2