• Sublime Core Feed
High Severity

Brand impersonation: Office 365 mail service

Labels

Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Sender analysis

Description

Detects messages from domains containing both 'o365' and 'mail' in the second-level domain, commonly used to impersonate legitimate Microsoft Office 365 mail services.

References

No references.

Sublime Security
Created Oct 10th, 2025 • Last updated Oct 10th, 2025
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and strings.icontains(sender.email.domain.sld, 'o365') 
and strings.icontains(sender.email.domain.sld, 'mail')
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started