High Severity

Brand impersonation: Deloitte LLC domain in CC

Labels

BEC/Fraud
Impersonation: Brand
Social engineering
Header analysis

Description

Flags inbound messages where a recipient in the CC field—either in the message itself or within a previous email thread included in the body—uses the deloittellc.com root domain. This can indicate an attempt to impersonate or leverage Deloitte's identity to add legitimacy to a message or exploit a hijacked thread.

References

No references.

Sublime Security
Created Sep 2nd, 2026 • Last updated Sep 2nd, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and (
  any(recipients.cc, .email.domain.root_domain == 'deloittellc.com')
  or any(body.previous_threads,
         any(.recipients.cc, .email.domain.root_domain == 'deloittellc.com')
  )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started