High Severity

Observed IOC: Malicious sender domains

Labels

BEC/Fraud

Credential Phishing

Malware/Ransomware

Impersonation: Domain

Social engineering

Sender analysis

Header analysis

Description

Detects inbound messages sent from known malicious sender domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

References

No references.

Sublime Security

Created Apr 24th, 2026 • Last updated Aug 28th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.domain.domain) in (
  '049a4890de5dead7b5b968c191d56aba74e4d96c3712c6016142c6e00b0bb7b6', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '093eb118a285207aba5a508be66c4a7f227537f9e3912b7edf627e534cf47515', // Observed malicious sender domain
  '2cab1cbee39b6e639cec3d46fb270eaf6fdbd66b24049e0aed8cb0746fd91ead', // Observed malicious sender domain
  '2d86a54a53f7a6d8db44135011f248f73bc6363208bb054781a5fd6cd5a68ef0', // Observed malicious sender domain
  '344964b8f8ee23b4c5ebb446b85722abae2e15fa30a710219b348f21c4c03ac1', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '57de556c3dca6746efdca2a9e9585a67373719879ac1213355d3d6daaa0ac286', // Observed malicious sender domain - actor-controlled login-code phishing from enumerated mailboxes
  '6798365fdfb2f39074e58d4221541c778ba593a099ad3b334224a1f992a63313', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '6f2681220ecf14f51e24f398daa4a0a5d8044fcccc67969bcfa5254e803b082c', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '90d3c2c031a19cd887556d924842fb4300dc3890429e9da2b5c267a862be7f9b', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  '9e2c4bc1eb5cce77acbd64fc1624f957dd73c2b98e55e0803f7bd85cf6b0a93b', // Observed malicious sender domain
  'a9a6c84a2bca28f6078381525770238c427000acc138ff47fb9139ffe54cf993', // Observed malicious sender domain
  'bc0b660d1726f95579835f2694c4f58c656f431fbbc810c7fc4d19f2b2a177d7', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'c1480544a7268086e197e9f1832e8a3a30d0a9a11b750a8d87e7188505e51682', // Observed malicious sender domain
  'd758b32f46a81a66e5844fc072486b6860625aea5a79e3051cf9df00a47c3f5d', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'de9e07c5b87055b27e8419cfd89485c7b374deec228dc51d6aa710c68de27965', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'ec74a3b1b533fa08aada394224a5fc46a60f02a84950d8085885dd0d61e9e9dd' // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.