Observed IOC: Malicious sender email addresses

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.email) in (
  '030e1018afa151eada89a993f1d9f1ef1ea436e17f929b634af3db3cddef702a', // Attacker-controlled domain - Aged domain repurposed with its own sending gateway and no legitimate traffic observed, delivering fabricated forwarded invoice threads from an invented risk advisory firm to accounts payable aliases, with the display name set to a recipient side finance contact and a reply-to carrying that contact's first name on attacker registered infrastructure
  '05c2551b17530710c9edbfd9bb7aaf8ec145b216edcbab069daae96f4aae908b', // Attacker-controlled throwaway account - executive impersonation BEC reply lures in a shared campaign
  '074cea08c9b5bea54c3e9a45ebfb3cb767dd0ec13a80df0a3cefd88c9f45a8e4', // Compromised mailbox on a Brazilian domain sending overdue invoice follow up reply bait with display names impersonating named executives at the recipient organisations
  '08361fdb828f15abcfaf7e041cdf3c6653157ca99c95fd8bf2ba8fde1fbc8f64', // Attacker-controlled domain - serialized new business inquiry BEC lures targeting real estate brokerage agents
  '0eb988e9f6aca75714c0aaf827336471dda7294b94b0e6d45617fbddae4c5f60', // Compromised education account - callback phishing fake invoice and order confirmation lures blind copied to Microsoft 365 group addresses
  '0f862ede934f0ce7b5c979aa9fd6fcfaa6dba5379d809b58a77066fcd52db733', // Advance fee fraud investment and partnership solicitations sent with no links or attachments from a recently registered domain
  '103dbd3c01a1e8ab0701fa982e5e3e4b0f1a93cdd85c5fe6e74d75b837818de1', // Attacker-controlled throwaway account - executive impersonation BEC reply lures in a shared campaign
  '117bd7906cccfd8296fa626aa59031c27b84af02c7374f8b3e1556b7023d99f9', // Attacker-registered domain - mortgage relief lead fraud fabricating a nonexistent federal homeowner relief program with invented file status and eligibility fields behind a compliant commercial footer
  '126ca3d8255f5e75ddae997d747eb0f5d9626c8a88dfa25687f314e640b873ac', // Attacker-controlled domain - Advance-fee investment solicitation using a forged reply chain
  '13375c5e50e0cb9fe6abab53cc810ef6168bca4630e56b1e5d3b0d2d132b5b9a', // Compromised Google account - calendar invite phishing sent as a mass event blast with a project proposal lure and a payload behind a mail tracker wrapped in a Google open redirect
  '13801d132a45b61db286894d9f5a75bcfd2a72d2774e28eb0be9306505a9f7fc', // Compromised mailbox on a Brazilian domain sending electronic signature and invoice approval lures through a commercial mail delivery service, linking to a credential collector on rotating wildcard subdomains of a single payload host
  '14e2a6e8c3b0aa75f25cafed155f6bd2c6111adc9bd239c1f48e394b5fe69d9d', // Attacker-controlled lookalike domain - subjectless campaign delivered via SendGrid with Klaviyo click tracker
  '15e7f8cef27a0cad985b0a21496fa70a28897ed56e9d8700ade048bab5307850', // Throwaway freemail account - executive impersonation requesting mobile number for SMS pivot
  '1fc806377e831e2a995bcd156644adbe2807db9c2b6c1a8c1fd0df9cb206e101', // Attacker-controlled domain - Advance-fee investment solicitation using a forged reply chain
  '239438cad30f816998539c67804547c18737a486989ce5da2e8e85a28f903f04', // Attacker typosquat domain impersonating STALAM S.p.A. - request for quotation BEC targeting industrial equipment suppliers
  '245e37a1bf65bb14a41e88c064f2bb0da3416c3fce1571df00095d885b848c8b', // Compromised education account - fake photo share spam with image attachments and a URL shortener redirect
  '2608a6edfde80841aef1493fa0a515bfee920a971bacf4adf40f6a4e0fe575c7', // Attacker-controlled domain - Purchase order phishing from a recently registered domain
  '26b456acbf4b9e71ab3f94c9c535aa7d280d99b00933dd152be5b7962639e224', // Compromised account - domain renewal payment phishing campaigns
  '287ef4e57d88f6a6e4bbbbf55299e35538d56b618a489507098adab51af2456e', // Compromised academic account - Advance fee reply bait using single character subjects and a fabricated honorific display name sent to undisclosed recipients with no links or attachments
  '2948295e37b555a1b3fd2318a0f4672eeb69a0dfc67283d8f6db19664729f089', // Observed malicious sender - blank subject campaign with unrendered mail merge tags redirecting to an attacker-controlled host
  '2fe6784be1bc4926bf3bc0e3df70ffeb0c21008f74b685c05657989c0ae481d5', // Attacker-controlled Amazon SES infrastructure - mail delivery report quarantine release credential phishing with recipient domain in body
  '3104c37963b8bcbeddbf158f6607384109dc6a9ec24f4610468690fb66f00cf3', // Attacker-controlled domain - Advance-fee investment solicitation using a forged reply chain
  '3443617deed56e58f109c3e65fff2d512e8ed1df6ce2918fbf9b73795c236286', // Compromised mailbox sending contract award lures impersonating multinational trading and manufacturing firms, with a randomized contract reference per message, a PDF attachment and an unrelated hijacked thread used as padding
  '35023d982780f5605437e9983a3a7e16246440087687647967df0e7ac899f306', // Attacker-controlled domain - account update credential phishing via self-hosted link tracker with freemail reply contact
  '385027ee5d05752d2a8e491752e8273ed1b79be079b56a9bd5ddc6e9f51ea86f', // Attacker-controlled domain - Fake calendar meeting acceptance notifications with click tracking redirect to credential harvesting
  '39199beecd8f3061935834e5b5aa220b63811cd706b9c86e7692df5742c29427', // Attacker-controlled domain - Vistage invoice fraud with zero-width character obfuscation in subject and display name, sent via SendGrid
  '39199beecd8f3061935834e5b5aa220b63811cd706b9c86e7692df5742c29427', // Attacker-controlled mailbox sending fabricated two-reply invoice approval threads that impersonate named executives of the targeted organizations, with zero-width joiners stuffed through the subject and body and reply-to addresses on a lookalike coaching domain
  '396651544737fd8be74a6eca3624e1cbdc8f6380e700f7d3482287f9ec3eebf2', // Attacker-controlled throwaway account - Meta business page verification credential phishing with Unicode-obfuscated subject and display name and numbered Netlify payload subdomains
  '3add803e0b5b9422e2ced3da98e73d71129ef521f72e8b9b50b2c1830876ad05', // Attacker-registered domain on a privacy registrar - product export supply request business email compromise to undisclosed recipients
  '3b79bcb8c1e81309e0e7b90d0b9937465d24a92cfb47c9f7e5c47abc3312947d', // Compromised mailbox sending webmail and control panel re-authentication lures that link to credential harvesting pages with the recipient address appended
  '3bec8e1bc42caa470c611cc5d481a2e0da08c240813a7427b9390f765a4304cc', // Compromised education account - callback phishing fake invoice and order confirmation lures blind copied to Microsoft 365 group addresses
  '3c432cce9b910a2c53ab65fe5c9583d94d3a7b860a5edd1b05ba747d7e45d55a', // Attacker-controlled domain - Lowes rewards prize lure sharing campaign infrastructure with junqelia24.pro and vexorin25.pro
  '3f9e2c465ed00925b6904065f599c2a605ee8f15f9fac73626754d28839e370a', // Compromised SendGrid account - credential phishing with randomized document review subjects
  '402c17a880aa812435c1057ecccbcffcce9219dab33029963f42556d3dd1f315', // Compromised account - Fabricated forwarded invoice thread from an invented risk advisory firm requesting same day disbursement, sent to accounts payable aliases with the display name set to a recipient side finance contact and a reply-to carrying that contact's first name on attacker registered infrastructure
  '41510787bec9cf8433d8a725e9cf8026a27c420e9e2ed20d4fb0218b95813e6d', // Compromised account - advance fee fraud workers compensation fund and inheritance lures with a freemail reply contact pivot
  '439643a337c503baf7d6117de41a7517ab9e8a909a750da397ccccc3c4f4a2a0', // Attacker-controlled domain - Lowes and Kobalt prize lure sharing campaign infrastructure with junqelia24.pro and zyntravo84.com
  '442df6d78e6570ebc5c956635a4697ed9223d0a17370a8dc7be465f4ff9220fd', // FedEx delivery exception credential phishing with a recipient-addressed greeting, sent via Mailjet and relayed through a Google Group, linking to a Google Sites landing page behind Mailjet click tracking
  '498030e0191b3c9b464b6c92e852a99e6ccd7989d95afd60c7124f45daec7ffd', // Compromised account - quotation request lure BEC campaigns with mismatched display name
  '4e37cbbc6a78fe1c2a8e9317fdd4b38569d11d647982213d6b2c7de9fcbc3075', // Compromised account - electronic signature and pending task credential phishing with a homoglyph in the subject, rotating English and Hebrew lures, sent via Amazon SES
  '50956a216c7edbacd20275707a65dadd1a22cf9e5e00001afaf1c24692124f44', // Attacker-controlled domain behind a privacy registrar - request for quotation reply-chain BEC targeting manufacturing recipients
  '50a5e066da1a7d65d81b3f233272b208c782688634445aeb3f4ae355a6ae6699', // Newly registered burner domain - executive impersonation requesting mobile number for SMS pivot
  '52460bcbe479bdce1c737d0af3f611143a81d5f12c8457b29c900905834bf0e0', // Attacker-controlled domain behind a privacy registrar - fake Microsoft 365 undelivered message quarantine release credential phishing delivered through Amazon SES
  '53ed891f2c0fb15fcce73a4e6731f1433874dea7d3ba000af1b7e840ed7e329a', // Compromised consumer ISP account - awaiting feedback reply-chain BEC pretexting with a mismatched reply-to
  '54a602967647e342e3389df15a9d2ce52453aa38800aad1449f1942b88c37736', // Attacker-controlled mailbox sending Adobe Acrobat shared spreadsheet lures as calendar invitations to a mass recipient list, pairing genuine Microsoft Teams and Adobe links with a single payload host for the credential collector
  '5502acdf89fe972ba391e8aa9355919a1c3f920947169bbd23da5c6383e18433', // Attacker-registered lookalike domain - fake Google review removal scam campaigns
  '57a8b399739a513c38fa4c2f88162f5890f9149b68c34f23e34c60b0fbeab39a', // Compromised education account - fake photo share spam with rotating display names and low reputation redirect link domains
  '598a485295137301401ff1465e9b304a38d6581d7c1e03a3d4de52921bbf38b2', // Lookalike domain impersonating Bapco Energies - export inquiry BEC with mismatched reply-to domain
  '5c0451dc24d7d3bc15e4e1997503b9a1c9c7b3cdcba37256b5fa3db0ae06c0da', // Attacker-controlled sending subdomain with no legitimate traffic observed, delivering bank themed credential phishing hosted on an open object storage bucket with genuine bank links included for cover and a generic single word subject
  '5d9e7e39076ea435f8576988c43d553a100d4cae977be38be72c523ea3c083d9', // Attacker-controlled domain - Advance-fee investment solicitation using a forged reply chain
  '5dd6751ee719a5b57e2e739450bbe782a9db7c1efb8768f7bc5e1b1bee59f578', // Compromised account - Costco and Paramount billing deactivation phishing with payloads on free dynamic DNS hosts
  '607317145cd319c8e765744a3bc9571743ba8c6d8e2d73c56e3eac33e51c0c09', // Observed malicious sender - blank subject campaign with unrendered mail merge tags redirecting through a relay host
  '6a99b8d4c267000b77d7b4e2425b0c7d9431d2bd1578931e03d47d519117f529', // Compromised mailbox sending electronic signature document lures personalized with the recipient name and employer, using template content copied from a legitimate hotel upgrade notification
  '6aebd83bec40c6ee0bbbc72e73a0985600cd2117909c912d30acea3877e45a99', // Compromised account - Web hosting and website builder domain expiry and renewal confirmation lures that name the recipient's own domain in the subject under hosting provider display names, with the credential collector hosted on unrelated compromised sites
  '7566929e0aaee17160795fdc01b84d1f01db7f05a2c9d394fef6663a037fb1eb', // Spoofed mailbox on an aged Swiss domain with no authenticated traffic observed, sending U.S. Securities and Exchange Commission compliance review lures through a commercial mail service that link to an SEC-themed subdomain on a compromised third party host with a per-message token
  '77066333496d1b2bb655b850ca4a10c3208cfe55c6c33c0bb342ce0c83e20f91', // Attacker-registered domain - free iPad Pro and free meal box giveaway scam personalised with the recipient street address
  '7764712fb8536e16376a3190b9991fe49a0da22deb4d77825518fd33270b8b0d', // Attacker-registered domain - Gilbane supplier onboarding fraud with reply-to and CC on freshly registered lookalike domains
  '7c117ed39641278555ae674d9e4d469eae35f1321a45934a31f09cddccabd3a7', // Attacker-controlled domain - fake document share via attacker-provisioned Dynamics 365 marketing tenant redirecting to compromised site with recipient email in URL fragment
  '7f77b7d523927054be14b400b3717a30dd4b1b166c98fbc8a6025eaef79bcce4', // Attacker-controlled mailbox sending single recipient investor and acquisition interest solicitations that name the target organisation in the subject, part of a family that rotates sending domains while reusing the same local parts
  '7f82c9f6763c54de2ac9ba07db314f0c99a4828c895aa7a0b139b22206e642c1', // Attacker-controlled domain - Advance-fee investment solicitation using a forged reply chain
  '858214f8881d63a66b52ab87585f04465a31875e77755fe489b8e2291fe1c593', // Compromised school account - digital invoice lure with PDF attachment
  '87e9b993e849e9b5c4ff25d84c5336bc5c19bb075746bd2ebeae5dd62d9a928c', // Compromised web application mailbox on a Belgian industrial coatings domain sending invoice acknowledgement and invoice reference notifications to accounting and finance role addresses, rotating personal display names across two interchangeable templates
  '884f1e72d6d37f3276787ac89269a88ca68b0500e4ae10dc4d5b0d40aefbaf4e', // Attacker-controlled domain - Generic document and performance review lures with rotating reference numbers sent from a dedicated sending subdomain
  '90532239b1578b0e6878831aa7f00018ca02d883358522101581a678025bedc5', // Attacker-registered domain - credential phishing with procedurally generated document and deliverable review subjects
  '98efda257ce741da148c18cdf32a60bb37952c322a9df9d9f996591b0670f52d', // Attacker-registered domain - title order and wire fraud lures spoofing a Chase title team address
  '9af400fa39126d7ad6a34adbd1bc681fdeec84e9542def79e3e49bd170bfe328', // Attacker-controlled domain - Advance-fee investment solicitation using a forged reply chain
  'a206e5b140de73c7ef373197d929c99a26ec416c7fdeef66ef7b4593a11c9595', // Attacker-controlled throwaway account - executive impersonation BEC reply lures in a shared campaign
  'a2bbaa6824197630b7b9fb12296405481f6d2224194559c1ee39a635f8603cfc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  'a2d3342c56299d5e48daec7cf9284b33bcae220d07721ff830228d562ec61eeb', // Compromised mailbox sending voice message notification lures that impersonate the recipient's own vendors and brokerage, carrying an audio attachment and a PDF named after the impersonated company
  'a30b9e5afabd2d3e32d4a4718cdbec3c44589f73fc271cf1c4daa1defb427a53', // Compromised consumer mailbox sending business email compromise reply bait that uses the name of the recipient organisation's own chief executive as the entire subject, with task oriented display names and no links or attachments
  'a3473438fe21318a0e950cf1c01309d84a8fb0bd287276e0dc90e33501d3e233', // Attacker-controlled domain - BuildingConnected impersonation credential phishing with visit tracking
  'a7fc25e74dec71054e0d8da967f612612fe926aa2fd29618d1ad4e9316e93988', // Attacker-controlled domain behind a privacy registrar - empty-subject fax transmission log lures using an Xfinity tracking open redirect to an Engagis OpenID credential prompt
  'a82572073c104d9e7e16599fe24e72479a1a7b3b96e6ba81b4df325881ded01b', // Attacker-registered domain - business email compromise first contact soliciting a fake client project with an out-of-band reply-to pivot to a separate attacker domain, targeting named executives
  'afb0d21be1abbccee6fcd98e8c1631ef7d6016fa170254a514063ebf25b75e75', // Attacker-controlled domain - UnitedHealth and Medicare impersonation with homoglyph brand evasion, payload hosted on the sending domain
  'b106dd71bc78df81afd5860eea4edaf996f729d0a780d9835d00238826afe22d', // Compromised account - Fake document share lure carrying a calendar invitation subject, appending a project collaboration and payment review request above genuine harvested internal threads, with the credential collector hosted on a business intelligence report sharing service and an instruction that the document opens only in a specific desktop reader
  'b31defc6924cd70ec55b87819a9f52b70e062a196fd4b978ebb19293d1159034', // Compromised account - Reply bait using a bare date and time stamp as the subject under a fabricated personal display name, carrying no links or attachments
  'b58c935841a746dbc45692664e6a5ab120a7ffaa6c393c4bc7cd41a7ed6a974f', // Attacker-controlled domain - Canadian law office impersonation using policy and proof of delivery reference lures
  'b9a82cb97b1149af434ea7d27a2c890ae256db2599642f8d3f2e5c5912c986c7', // Compromised mailbox sending payment advice and invoice notifications that link to a credential harvesting page on a compromised third party site with the recipient address base64 encoded in the query string
  'be44430a667b7776e351cf54a66f85716de0731dcb1245b7c5bca081e4cd80a5', // Observed malicious sender
  'be75194b73d1bb258beb4ab257211d4ba6be240a485d60b2f4346b4d3171d5e4', // Attacker-controlled domain registered days before use - BEC first contact with an alphanumeric reference code subject
  'bf5d4be8d2cee2476e9a226bd955f41819e4b01976f9bbd91b58bc82f057d4f6', // Observed malicious sender
  'c7002c818554a96b3b43e765a545629fc7775d81e07eb7347ab18df4009238bc', // Compromised mailbox sending rotating display names and lures including courier invoice billing, retail supplier onboarding impersonation and advance fee funding solicitations
  'cd020f36af6c65e3953816094eee6b2e57f888d01cf00de9017ff4d3c63f8e07', // Attacker-controlled domain - Advance-fee investment solicitation using a forged reply chain
  'd2054a6e46579b0fc8989a68341493244d9d2723d99518097f9cb7658a50925a', // Attacker-controlled mailbox sending the same fabricated invoice approval thread template with zero-width joiner stuffing and executive impersonation reply-to pivots
  'd7ad624db0f99531a9ca2112fb0d6cb3fadebeb59e26bcdb31ccedba70025ef4', // Compromised account - Advance fee fraud using purchase order and humanitarian appeal pretexts
  'da268f9fb00a69d53b1eae18e8b99ab789285c273186a7c3049abbd9bf653888', // Compromised mailbox on a bank domain sending document approval and endorsement request lures through a commercial mail service, with a freemail reply-to address and no link to the sending organization
  'da49b4eac0eb49d4f34e98c1fd42a768c3100e572579fede85eacf58141a53f5', // Attacker-registered domain - survey and prize scam with a fake address embedded in the display name, empty body text and a tracker to URL shortener redirect chain, rotating German, French and English lures
  'da53b2817a57c3914b74d12c9bfd9a88299a52b595401bc495c3ac85cfbb5521', // Compromised education account - callback phishing fake invoice and order confirmation lures blind copied to Microsoft 365 group addresses
  'de7deda77de750c100c517564cbf2ffbec72001d31203ed7eb5c45635945ea5f', // Attacker-controlled Amazon SES infrastructure - mail delivery report quarantine release credential phishing with per-recipient display name spoofing
  'dff78965cc2c55b284990806f57a9ac6c4da7e50271a5a1473fb7b6bd557ff4e', // Attacker-registered domain - purchase order and RFQ review BEC lures behind an unscannable Cloudflare link
  'e14602a3a36e73fc4fbf932333809010eff1ed6c07212a6fbc8532409b23f7a4', // Compromised mailbox sending petroleum supply mandate solicitations and webmail re-authentication lures that link to a credential harvesting page with the recipient address in the query string
  'e2620d4a65bea7f44f6b7ae4913e97fb3eac30be5e4fa57f0c4a3fecf6d70328', // Attacker-controlled sending identity - draft agreement electronic signature credential phishing with a randomized document token per message sent via Amazon SES
  'e310d5750cd1febb021b219420e56fefbf1012ff9a69d117ce438f8cb186f986', // Compromised mailbox sending strategic partnership solicitations that impersonate a US display manufacturer, signing with the real company address and website while the reply-to points to a lookalike of that company's domain
  'e328f980f9c6804e9d9743513cd829f1ea15fa31abd7c08f71449bf6f138974d', // Compromised consumer mailbox sending business email compromise threads that use the target company name as the subject and rotate display names between generic office personas and third party addresses
  'e39218d8dd92ed4eabe4417733d40cfafe7de1fcce268bef9f33f624c9a90152', // Compromised account - recruiter corporate bill invoice fraud with generated PDF attachments
  'e4698773a1b89a6bee3574d926aa4c7674ba935011837f083081628e5a489c9e', // Attacker-controlled mailbox on a recently registered privacy-protected domain sending family office investment interest business email compromise lures that reference the recipient organization by name
  'e901d770887dbe85b3be7f3bb6bc21532a0b5c52a970bc987f44dd84e1bdaff3', // Compromised account - advance fee fraud fabricating a pandemic relief compensation program alongside strategic partnership solicitations
  'eaef6d29428f22885109b201072d03826b5579b4b84658ab69e637659feabcc6', // Newly registered burner domain - executive impersonation requesting mobile number for SMS pivot
  'ec4d88b19187452ee9d714b49f30e3cf61bf7238b7016a9e582efe3c6333f3c1', // Compromised mailbox on an aged Philippine publishing domain sending enterprise risk management review reply bait that names an impersonated executive in both the display name and the subject, with no links or attachments
  'edfb40dac1262130a8ce7d0ecc39957b166b13adb1ba18839da183873383ac16', // Compromised university account - advance fee investment proposal fraud using reply-prefixed subjects to imply an existing thread
  'ee4873fd02b2832cc47f937d09368e26b08589967552c22551efc3d45856384d', // Attacker-controlled throwaway account - Meta business page verification credential phishing with Unicode-obfuscated subject and display name and numbered Netlify payload subdomains
  'f206926f3b476970e4132e3d9dd32170a5e991d5fba5883389f1d4a18c39aa40', // Attacker-controlled domain - request for quotation lure with excessive URL rewrite encoder chain
  'f22db0dbcc4d9b60c0562a4f2f95c505d54511a6b0ece819f2fb76010a97cf13', // Attacker-controlled domain - loan lead fraud fabricating a specific pending payout owed to the recipient to drive a personal information funnel behind a compliant commercial footer
  'f33c82ad311018d7a88bf14b94be5cfa42afdbe529edc8086b0c11e1159648df', // Privacy mail burner account - executive impersonation requesting mobile number for SMS pivot
  'f567a285d1be7a066863ef3716adfdfdb3aed8cb00789e79bd87dbdad76637a2', // Attacker-registered domain - discounted internet billing scam with the payload hosted on the sending domain
  'f88ea669b8f785c1afc0c04e15b412a1e7199c542b69fae9fc83a3260b9181f2', // Attacker-controlled domain behind a privacy registrar - fake EE rewards points expiry credential phishing delivered through SendGrid
  'f8a60aaa8eaa89b20e994b627d045830e9a032c97d3002856e2157bb328c388e', // Attacker-controlled domain - Canadian law office impersonation using policy and proof of delivery reference lures, rotation of ericmcooeyesprofessionalcorp.com
  'f9b86f2c1b24b819d8748179ee44672d786d5c826a0d7c4e4385a976c5100b58', // Attacker-controlled mailbox sending American Express account notification and Internal Revenue Service tax document lures that redirect through a consumer link shortener while citing genuine agency links for legitimacy
  'fa85690cd62ab68ed9168a43567f2868fa120aa73565a082a87443877d0c25e6', // Attacker-controlled domain - multi-lure credential phishing and BEC with homoglyph brand and university display name spoofing
  'fcf380341ec080be2082bbf4c3a21fcd5dc2d79f5b50d7bc868c83f96ca6631d' // Attacker-registered domain - executive impersonation BEC reply lures
)