Medium Severity

Credential phishing: Fake security alert from newly registered domain

Labels

Credential Phishing

Social engineering

Description

Flags inbound messages from newly registered sender domains (less than 90 days old) that mimic account security notifications, referencing unusual sign-in or login activity, and containing multiple hallmark details such as IP address, device, location, or time—common indicators of credential phishing lures impersonating security alerts.

References

No references.

Sublime Security

Created Sep 17th, 2026 • Last updated Sep 17th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and network.whois(sender.email.domain).days_old < 90
and any([subject.base, body.current_thread.text],
        regex.icontains(.,
                        'unusual (?:sign[-\s]in|login)',
                        'sign[-\s]in activity',
                        'account security (?:notice|alert)'
        )
)
and 2 of (
  strings.icontains(body.current_thread.text, 'ip address:'),
  strings.icontains(body.current_thread.text, 'device:'),
  strings.icontains(body.current_thread.text, 'no action is required'),
  regex.icontains(body.current_thread.text, 'location.{0,30}:'),
  regex.icontains(body.current_thread.text, '(?:date\s(?:and|&)\s)?time:')
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.