Description

Detects email messages that contain (anonymous|smtp)fox in the sender email address, X-Authenticated-Sender or X-Sender fields. This is indicative of messages sourced from an AnonymousFox compromised website.

Sublime Security
Created Aug 17th, 2023 • Last updated Jul 8th, 2026
Source
type.inbound
and (
  any(headers.hops,
      any(.fields,
          regex.icontains(.name, "^(X-Authenticated-Sender|X-Sender)")
          and regex.icontains(.value, "(anonymous|smtp)fox-")
      )
  )
  or regex.icontains(sender.email.email, "(anonymous|smtp)fox-")
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started