High Severity

Observed IOC: Malicious root domains in body links

Labels

Credential Phishing

Malware/Ransomware

Description

Detects inbound messages containing links to known malicious root domains in the message body. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

References

No references.

Sublime Security

Created Apr 24th, 2026 • Last updated Sep 4th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and any(body.current_thread.links,
        hash.sha256(.href_url.domain.root_domain) in (
          '0defae6129a85bea445da8c8c890caf065ba48ff13bc901e7dd51663251ab507', // Fake voicemail notification credential phishing infrastructure
          'ee7c8613ad19ce2148ab3f305a99d85e2f299a67fb763c4d3ac15cce76949c38', // Fake voicemail notification credential phishing infrastructure
          'ff09b48f176b08a19ae3301af5aa07a4c930526db8abcac16297d9c300e030e2' // Google lookalike credential phishing infrastructure
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.