// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.email) in (
'0004f01dc9ee385b299b774fbd0010c6da8164833d2ca0816ba648085e49051a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'0025925158ebaf2924dc24ff2d2c31c8613e2023b5bae2101cb1e752ff187eba', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'00d63ceac2fd6e0420e5b39810077268b95dc4f4596d6185fdd68a634acfa1e0', // Attacker-registered domain - BEC reconnaissance campaigns
'01eb9fff727d15c5fac229c9db4173d44988389daf483be57e7b8f35e66bb51f', // Observed malicious sender - advance-fee investment fraud campaigns
'03f4447e4e825556bd7f47093b610e80f7962b0dfa62027b8e5f4315d7856d62', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'04dccb790fc71da69d21ff741dc56881f76c5f04714da607df676756ce93d82b', // Compromised Russian domain - USPS survey reward phishing hosted on Google Cloud Storage
'054a555253046cedcbcec7ef343b0b7e3ad923a016c08c45e9346dba1bd30726', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'057761a14911145dd930fac2ae3362ee5478bda82cfe87ea89aacd86a95cd6af', // Observed malicious sender - compromised SendGrid tenant, fake Teams invite credphish
'05ade64fe819dabde607772648db630b90b1831b31ddbd932b17e0559d59c00e', // Observed malicious sender
'062a0829f242e71ffaa3943294a6f4e9f504510813a5ee83c457bce0c6c74e11', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'071e6532db98bebbb6d5ec4656f371c2f5237ef3ff6bc599804bd0160c7f9517', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'072ad26b13508033eebde6e5070cf6d8aa09d7414d64da7b69bd82f6e8f683bb', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'07447603538582dab2e8ee62920a7435cc9b756bcbc7f94054d373b6232460d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'07e949af128ffe2f19d3e20b0ae03343a7b3b150d9a321201b2c7580e014ed36', // Compromised account - fake financial planning report credential phishing campaigns
'0a9244cdee70d32d8065e20e52c7bd8dd5f45b1c9667f0a60f8b03e1398bbf71', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'0c79c4fa99676652637adf509395f6fb474922e08f1760b48d45acf37961a0a1', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'0ca5c2997f598b24a2c38db307b5cb3567029b7f0decc9de88fa9b73442c1899', // Observed malicious sender
'0d3de488a096b39ceb2db13ba7f68374049e2de2e0be6c2da9ef0d83c9337d24', // Observed malicious sender - advance-fee investment fraud campaigns
'0d708fdcc014db960b64ce93255c64a60884612cc2dc9c830b5638b950b4fedf', // Observed malicious sender - BEC/credential phishing campaigns
'0d7906e61f89af2bfbe63d749ec7681950410a81819baf307ed26a2a4ceb5605', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'0d9d6401c0cffb024be34cedf19034966d01454e802cd2df9206a9eead1823a8', // Compromised account used in BEC/credential phishing campaigns
'0e353d693172e5409d8f7efca3f274a0f9c568142615a865ce013bb2cfdc71f7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'0f1d80cdfbcd7b28945e0aa96ca1adbf3e69bc9b3c80b62bb240254df8bf6d24', // Compromised account - advance-fee grant program notification fraud campaigns
'0fe6070072580c44577931b8b61febab507e1721439481777a3c8ef218950189', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'110e998853b48917bec1721e5de346da6bb59e56c81b3d7a7218521455321527', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'1127c5e25e2155b4e9a1aa7ebfd0269373697032eb6d037b2b1773636620777f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'12170cccd307602216eac235d3176f547ce89fb492eccbdbed19a2748f7264fb', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'12e43526e75cf27e10b97b0c1d7f673028450020031ada7e21525a12ad174724', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'131f2f1f4d53adf813008ef0442f741800589f6c80d2ed75022de3cbfb19699d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'14f25726353bf0377a6f0dd943e3fea2ee8dae88995dcb9997560fd00d17b155', // Compromised account - Air Canada brand impersonation credential phishing campaigns
'163b9a33530479a7d10487a6aa5751185d49da4264329153ba609094fb22655f', // Compromised account - Japanese company domain used in BEC campaigns
'16527a63209b668a15eb474b91b7bbb7a5c8282e4dcd8ce68044772677855c2b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'16599313a98b7432e9756a1c4ab7693b454850ba025a23a656d15ed643fe2014', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'16944bb3724b4ecb0ffcfd5634fdc373b76891e6689e754154032777ebe12c6a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'16f9b3c2bb2663806fe91a6c76c0033018b7d090488076cd3fd4c9bc0c3ff799', // Observed malicious sender - advance-fee investment fraud campaigns
'1798bdb84f24fcc6b5442071fa1c405457ea5dcc73c3f0540e4280ebec041d3e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'18159738ec9f5632b7ad61fbae18fabb29ed90cbc1694be99783a67d16caa2ec', // Compromised Spanish food supplier account - RFP proposal lure with PDF attachment
'185d468c1a67af5f7943dfe4142e6557f027bce99c3fae3bb5c532358806df7c', // Observed malicious sender
'1899d688514d0651536482339e377683b86b96a0eb673de2badef384a8f7f3d4', // Attacker-registered domain - Kroger Boost membership renewal credential phishing campaigns
'18ac731a9858023e2b59114b6a861e10858c8d577ddf7ca7f7dd13984166a83e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'19c288bd2baa150a12078d1310c3094b2ddd7fda8ba42d283be861a50615a924', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'1a01ef4c29dcd924f903c6d2af54335acecf5e2289a41d69f1799005d07a8a0f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'1a80fa436062f7deeea549b7f4d2b9db44c4ffef9d153fa8566a478de2876118', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'1acbc86f2347911378c5803f3fff4b2db5e8355ebd1a656e7da89cea3b4479e0', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'1b3f7a9f96d368268612f38aa535178ba2905ded7773a7dc15a93628bfc854e4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'1daa2ca8844ce276e570e75eaf1562b79086ad846dad24108646c066b97961bf', // Compromised account - mortgage payoff and title request BEC campaigns impersonating Shellpoint and Wells Fargo
'1dc7009cf08e4a9891c9e9fa26201263f29826ea71bfd629400ec376a58fda00', // Compromised account - fake financial planning report credential phishing campaigns
'1f9f044f5f4f108480264b5df8b623215c9d2e425331a22d67e6709fce0bef0a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'1ff9e668661c28c3abda5d497fe4966037a01e10063bcd1d644b8ea21bca92c5', // Compromised account - Google Calendar invite document share credential phishing campaigns
'2040a34f81cfa9b83e25fd49aa853ea55e2af03c2f6bb521d02babc94c25359d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'204eba38fc8bee6f69aec26501c467259dc7edf2bf0bab8f90ca9d73e382c38b', // Observed malicious sender - advance-fee investment and project financing fraud campaigns
'21052473616c4c0ccf7ef7bbd2b3d35cc082ebfa051526d86e7d359b80c4130d', // Compromised account - fake financial planning report credential phishing campaigns
'217fb9a42153586697f35abd87908d13cd821c1e90769b8f6601ece91455718d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'236f39a7019cf6e51a95de2074e17ffc6f5552c3c6c999cf34683b88915d756f', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'2383fd0534e334243246377850eda12c5a29edff93259caa91e543acef30fcf4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'23c62826bbcf57ba73b802de9ff676e7c470ef20d3b6651a81b371fa3e00bbf1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'23d30b83c60509d03e79c2673ab0c1b9a9fe5dda07a2198df43038cb153d7ae7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'2428a08e180812cb74fb0930df94d299f444403a4cedc2fdb958e4de0ca72517', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'249fdecf8c13707087a66615e8777af844873136dca22dce66955a9fa0c62f54', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'251a75c039f8a8084b1946923a671bbd3370283fc824fe0f9ec2faccb6f0fd4e', // Compromised account - Google Calendar invite proposal review credential phishing campaigns
'269e21e213e3e7db224f86a0fa4fdd5c17040abaf42eeed5b862ccb14965af78', // Compromised account - Google Calendar invite voicemail notification credential phishing campaigns
'26b381b3dee0a016f99bc1837a38bf87a4bd3201147c522dfe826b3ff2deafd9', // Compromised SendGrid sending account - credential phishing via fake Teams audit task notifications
'282e90ee0f5ded51b49c9bf06be61ae70fe455282a3719ad2dba9aff3dc9757b', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'287a3feb51527264b034738d5f654c9c3f6d4d85ab8ea0f9e04defcd42c85f95', // Observed malicious sender - BEC/credential phishing campaigns
'298e3bbd5441f58bf33082da80ae0229cd0fa17054e3432199414a4706d05bc8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'2a9b9e226f23ec6375ea7fbc73d2dfe2bfe4d0e09a8ed002226ad2c54659ba50', // Observed malicious sender - Chinese-language enterprise mailbox credential phishing campaigns
'2afc248495bb3858d1f160f8cdf23f86c51e2b2d6b2799750658f48184ddbffe', // Compromised sending account - credential phishing via fake Teams audit task notifications
'2bca99dc80ed69d4ff757ed3259882862b107fc6ecc72ce030123954aa896182', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'2c61e0a0f6d48553de52c70d5c84242ee8b550016aa6fdb36abd9c8d7daf624c', // Attacker-registered domain - fake family office investment solicitation BEC campaigns
'2d9d53c3991cd29ded163caaca5379f9ed2bad0e90cbee80f494a7003fc4ba29', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'2ded1c3fefd56268abc47bba7573bc15cd7439037faa2b99044e205402f5ade3', // Observed malicious sender - BEC/credential phishing campaigns
'30497db58c2865530f352d8605072c6cdcb553d496ab237fc3196f3133795c25', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'306bddcc8efbeed15553380ede95273d10438f4e4d8190963bd1cc58178560d1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'3190d9232f76f2636a06b1e39d934ddd23774e978ff5a5239eb4aa9eafd5e806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'36387b3610f581c3ff95f77130dc8faa8cf2046b0e610f4138bbe89651f4afff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'38347ae9a4c20cbd3d4908c29e5046d2ad5026a28e7d3ce482151ac7d2bf588c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'38a8e112af8d9252b3f51a8ba94003631bc4c9bf6ef60941521169382c8f546e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'3a11180346d6de0d66d38dfe9482b0fd998183d30f10d02940d1caf458457d16', // Compromised account - Polish school domain used in BEC campaigns
'3abf8f34e546677fd2a4ec081bcd6ec11d80fcadd49e83b342a9aec6fb723231', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'3c6d0480a53df3b3c3e2c27a210d99d9704e02814e1d11507e02490695eb8806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'3fa83cd162a4f95f91d8cd28016dd8b1e557ee3a96e98ec0110ce7f22e387a24', // Observed malicious sender - Kroger brand impersonation credential phishing campaigns
'40742af9c50cbbdd54fda2fedaf88429d78e34f6df5cc0b34fe7851b354472cb', // Attacker registered domain - fake billing review credential phishing
'416423ad3b195a68f1f8cea67899e4eaf97428c128e2ae30c3fa607f8951c0d6', // Compromised account - Vietnamese university domain used in BEC campaigns
'4218528d5686b4329c1e288e27482db00b4f97b4051e5422cc9df53e89242497', // Compromised Portuguese business account - fake photo share credphish campaigns
'4249dea393334f7526450a59092d3ae3c2b57ce5473ac8c43700a1811b24b79a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'4329b35c2cbed4d8f479f1b8d0bae5f255d292714d3c80e3366d7710fe91a238', // Compromised account - Google Calendar invite investment agreement credential phishing campaigns
'432c7e156912e0fa9d5a3e5c387547d19920de54f563f4cbd1662382173feecc', // Compromised university student account - fake photo share spam campaigns
'4364378d659a6b97ddec4f37fff2c59c7fabfc4e576fb5876ac2e9bcec31d542', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'43e610255bac2342a7f16f0a442962e8f9a13b90a37425d31ddbd88b058d0d9d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'4547ca0494e63d10a82797da1a0b7835a90ee19961382ab3bf05bafdba7c97fd', // Observed malicious sender
'45c0c14258e227b8c1b8cfaad30d10351bfa68c9a5e03a52927943b4f6049eff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'48736e8d6c36f5232121bc9d9f0a148a09430a3b718695ca296abcb067530284', // Compromised account - Austrian school domain used in BEC campaigns
'48f87ee437793b1d2f8faf51dd2a5748f7a67f67fc0b168e861beeb28f371b59', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'491e0d4561fbe866b20d6aab02fc7946b1483e4dea0e4c1493aae7ccac292317', // Compromised account - Google Calendar invite Google Voice notification credential phishing campaigns
'4a58b3d01a91249092babaf3eb56cb37e84e7cfd6a6775a2329b1e5a81993fe1', // Compromised Vietnamese university account - fake photo share credphish campaigns
'4bbfbe585e83799ffa2106122425812356eb4ed0559fae8353614052651242ab', // Compromised account - fake financial planning report credential phishing campaigns
'4bd612d0513e4be9d62a13fff090a163b7fe55534ee8cd6a95b4f925d558210a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'4c254e837ad5e81e0d5316f4a12030b6112577955af3ab7900481835f555bd7f', // Observed malicious sender - advance-fee investment fraud campaigns
'4fc1f40c3dce21cdc1416a0932cdacd9b8cf20c6cd8993c3f5784bf4d6b9fc4c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5072d99c5b7c54ed31bdacd396a646a237dc7921822f442a2d36bc63eb3ded7b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5088966877d8065394ac600df092d315bbb7e8a3ba18f1bc1e46bf12118bbc35', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'50ae47f0a347fc4f9403361b5626f2397657d768196afe7378fe613e9077102f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'50d289addef8c2b6b33f72f069f979042f0878135ed471d00c3a3d1070a0f3d2', // Compromised account - device code phishing via fake legal case notification hosted on UiPath cloud app
'521f15c8df742711d6a5e41077569037c45205d73b0ef79b6b7c7b1a947db397', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5391de7846661fb33542db455596519a99ea1e83bea306a15e8e729568338e72', // Compromised Brazilian company account - BEC wire authorization credential phishing campaigns
'5447e4ec5e0b1c994debe4edd595ed538edae9b1a0dfd8b9158ee3af0d958fdf', // Compromised Australian basketball organization - encrypted PDF password lures
'54c49afa6a2b40d9ef8cef1be579a62fd941070d5d423ed44ca02d7a75c78f99', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'54e9c00529e925b43d578e8b1cb5efa2c634992ff871b98715b10d96b49c97c3', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5502acdf89fe972ba391e8aa9355919a1c3f920947169bbd23da5c6383e18433', // Attacker-registered lookalike domain - fake Google review removal scam campaigns
'563d4aedcf31889fc01fc1c240622d35285a988856bad72f11c5f85ff7372ea6', // Compromised account - Google Calendar invite voice message notification credential phishing campaigns
'57bbac04d703d41541706ec03ff4d8fee40b52b3343224a9e85baff3ff7de90a', // Compromised student account - fake forwarded thread and fake photo share link phishing campaigns
'5915f865d7aa335645d6eb8c6de4f2b555044da805cb699d7ef144ef7e4db0c1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'597628907508fd4ba364bbe8113d950b95fe07511d077043c8a2b266e3cdedc7', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'59f89167e3c871f5ffb2555333b868a28af9fded8b99d5718b4c760ed98bccb3', // Compromised account - Google Calendar invite voicemail notification credential phishing campaigns
'5a13688445cbe7a317357c3965cc5cba2db610fb18eee85c8cef43937b9d0c0f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5a3e0172e9f47403a5211107fa7bf4f9e4c123db10bce71a56dd24dab210472b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5b508f66848ab601fd3544c927b095362b884ff7c96a863e5c4ca898b25ba290', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5c5ad5fda56f9659a2c1710d37f94eb2da19e941e75d9b59ccbd85b44a7b99ed', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5c693feb863201cf47f7845815eda91bb3f5cb80d0cca995f18c939fefecf21a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5e06e423fbf619f98f0aa67b0bce107c85e8e53e65e1c9a58997b306773cfadb', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5e2e52955873f748b0ea3ba7853953efeec8e544643626b52c4f189933dc359a', // Compromised account - used in Google Calendar invite fake voicemail credential phishing campaigns
'5ec704a8f5f01a6fa672656573abf9c70154a1a2af0a3123406afb3091ef0537', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'5ed0e370c836d1063ec5998e7f34557f33e35defd1d3b4196efbda94c8883f4e', // Compromised account - fake financial planning report credential phishing campaigns
'6057ccf37d8286e1ae7d8dfd1789fe60791f2bc39600631f0551712cc8661e5e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'637bfb85dc1f4f13ca89f1ecae0ea67745800e25d2ffe8a7ac89ac3fd961c944', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'63fc0efb6cb07fe669b6baff257143075488f457fa2571ab86d10e5316d66483', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'66771511747b19c3015adbbadd4e1d54d0db51c646f3c28b34b1fa09ee772afe', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'66c1dd9579c2c6120ceef211cbde79e0bb2da9d92fc0a35d4925bcb7d0094edb', // Compromised account - used in Google Calendar invite credential phishing campaigns
'6743c1d4689d9c0b1f807a7ae8b69676b42a6ce33df41ec51f471afe39c13367', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'6777231b6c945ebef989e3c0cfd506bd36f312e4e72759c20240f975efba3b00', // Compromised student account - fake photo share and fake forwarded thread campaigns
'682690942d17fcfdab558aeb4dc2731f51666adabfad813e1f4b6e3843a2c605', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'68e096fe2d9e586026cbe19d4b718ab64b0f4aae0aca3021c0f77e6f5e7512ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'69445041cb7a92d9283d016fe79f20ca740aa4244afa966df1f27c9c1f9ab0cd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'69bb39e7e9fc344ed53bf59bf46ab39601ff098e1fe28730f5dbdb6dd5cc2e92', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'6abb620f683ee3a848295b4343b27d99c8269f1b1e99061d04f292730f1c15ad', // Observed malicious sender - fake voicemail notifications via Google Calendar invites for credential phishing
'6ba83ae804722e49e6e3b876b5830dfe6044b5b8767aed9d5b2e2b168b835cde', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'6bcb6d890034877d208a211b2b2fc4e34e477a4a588c610f7ddd6d4fcad30821', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'6dd1daf7fab34d399a3307b0ab85a2c7d4ae4f9e42e0a226811f6d4d362b9d4c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'6e1a4b9a4e87f3662a43c97e51763812ebc97b5e8f919a6fcb76cb1b892492e9', // Compromised Egyptian university account - thread hijacking with credential phishing link
'6f9a75a9a30c46798d67cf29265c8fb9255d05f9929156470c87e85a19f83254', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'6fcd011c929ff7d871d21375e5e9468b49397a566524bc9f57ec022dbe047c04', // Observed malicious sender - advance-fee investment fraud campaigns
'7044b353baffec52f9de4bb653e76485c6829328443d7fbd6f38fdd160c16055', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'70855e72100e8ada3eddeacd781116929015ed87284dfdac46ec680ad4aaa193', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'70e1030db9d32f156df07d445ee2bdc71fa37d3e9cde4418c5db6e2560f711cc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'72d595614ffddf30da8d74c9b206c6625d24f3b66703e7d4bbe79bd6c87221ce', // Compromised sending account - credential phishing via fake Teams audit task notifications
'73267f82cfef50641282935512e3d291d2c681aebd58c8ba7950af8236626912', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'746f335cb574668d6e435e21e98a800e6b7bf92dde423963ef5aede5712ada2b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'7516a9a2ed9016192434dd81db055d23dccba29731343f12be7f7dcb324a439e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'762c9ce5b716f3b385559fb09e7510661267797ea556eb866cbd1727424fdaca', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'766d628cd39125d9a6bce62dff3203cdc47d1a74e83f05157ad4fd28771974cd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'77161658a8ef858b15e320fe5bc309dae9aa0384ed235fbc3ad4cf5a2e725747', // Observed malicious sender
'778164c7dca578e67b6d2adfbd280c54f233f7321f351f7536f19ca5ec032acc', // Compromised account - used in fake voicemail notification credential phishing campaigns
'77dbd254b71aedc57d3247f9273b23a0ff191ebeafd4fe231048959f0191d524', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'77df91f5bd3c2e212d6a97a37f9096c7066a38ef5df4da445a83a5a8f8f94500', // Compromised account - fake voicemail and remittance notice credential phishing campaigns
'7c8569f4156a396673e5509f5c3a4b1aaf30761802631478bd59bec9c2ff0459', // Attacker-registered domain - German language inheritance advance fee fraud campaigns
'7d3ecab1afc389186703af31545b4b7485ff20ad130167d641a178bf88850f1f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'7f6a1cadfd6cbdc412e25021725006324d84aeb4ba3e366d772e92887937bf15', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'80c2073c491f2330f6f9d87cfd0e9ca485ef3cb293c2fb8759a6edefa45ed0be', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'8280e33a27a19991f81efef619f438403176fe91bbcd947df333b7eac77a092b', // Compromised Argentine company account - BEC business inquiry campaigns
'85041984096b0421bae2ee2f3d8b226f5d3335323af69ad44ff427059642856b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'87eb1efe1ab4ff5ef8767c19f6ccd837b2dac092b70092b56e3e59302035ad84', // Observed malicious sender - Norton subscription renewal credential phishing campaigns
'888a5bb142e1da435425a770cb0926d4ad613f7d972c22d2e01cf9f59a0d685c', // Compromised French hospital account - advance fee fraud and BEC campaigns
'894310051f1fe1fde08f6254d7909481b182338dca784c0dfc4c8b71134cf776', // Attacker domain impersonating Indian bank - BEC lien waiver fraud targeting construction companies
'89f1d71e971311f8d39a86a1bffa3b8c66f9e4c6569050af6424ae77d45242ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'8a47d2234827f5ded1d6bc235b16bf78b6f993c5799b4145888de15ba9a5e741', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'8b6199148560383d2fca031052475ca2627637fdf4a883dd475c9f3a51d39887', // Attacker-registered domain - Kroger Boost membership renewal credential phishing campaigns
'8c4ffc408b379a7649bef8b6fe6dedf467960627897eae7742091d98fc79a263', // Attacker-registered domain - fake family office investment solicitation BEC campaigns
'8ccd1976165c5acf2be6d44e89c95808574b584a2289354059554ba92f3ee355', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'8d0a6552bc32f3704106dcbdd393c73ceb29a4bbfd7f0ec207ea438c757b608e', // Compromised Vietnamese bank account - advance fee fraud gift and prize campaigns
'8d6d35f92d52490cfd8c2153a979604b95aabb430eef256486600075465e80b8', // Compromised Kenyan school account - thread hijacking with credential phishing link
'8f70301abb6faa9b1b0463bda1a42a153a49c849dae45c24ca087b49cbd6f16f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'904e10d30ea2b3ba2f2a8b79645b18998e47d13258a03577242d65b3367fbd10', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'91af23121133f55ed3e3daa4f519c76565806472292d4cedbc2c2ceda0aff059', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'91fe8f768fdef0efacb6325ad65b4d5922789d49dc2b253e7e352367ac8608fc', // Observed malicious sender - advance-fee investment fraud campaigns
'92b022313ffa3406da6cb095c2f8aa3404b401fea6ff9786f748663b9da6539f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'9308f38304b1c6734b5af78a959120435650e408854fc5fb98e0d9f8d4ed4a79', // Compromised account - used in fake bid invitation credential phishing campaigns
'9472ab67914ca4eb86fb7c4b726bef67c194bbbd430871570e53ba148099c502', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'949999f91a3feac5a7b82ce881d1a32f8aea674ff928f5a7f8950076033272d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'94a586de7ec274964f27506d5f27a6d717a1d472306017737ea067830889fb98', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'95f01da32fea6a5c28b5453568b7d3977a76e3ae42e7375534f22cd5c43c089a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'970950880f23d7bc62e6e9622fabb162f846ca06134163b426951c4d62db026d', // Compromised account - fake eDocument task and Microsoft Teams document share credential phishing campaigns
'99563d51af8f00be8f300763fd1a9dd2a1b38bf4d7d5d1fa370384a1f914f712', // Compromised account - German language inheritance advance fee fraud impersonating Bank of England
'99673797051adaeb68dc8b07624ba300472cf9cff1a995fa1f95d8b6685374dc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'9b3afc720c7975523f572be5e2b8e75a2567257a834e73ba3c11eeae4c53467b', // Attacker domain - fake eForm/spreadsheet sharing via SendGrid abuse
'9b4bc1752d36bb4718a2a30342761e8ccecb5d64dc9164c3127dab30614811d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'9b63750b1536d04005384932eb91499527e5f8ce9f7c8508ed7fe52e4060b0bd', // Observed malicious sender
'9da7b0641362e72b2db1ac186183e105c337696be87a2c8c1d3bee3e471f92fb', // Compromised account - US medical center domain used in RFP/proposal lure campaigns
'9e42f010967e7707cee3452bc8b9707df429c34be2dfc1ec3014392f696cb2c2', // Compromised account - used in Google Calendar invite RFP credential phishing campaigns
'9ee9228bc6dcb8628d144d63c21d436f427719672dc1ff01e9f5845059424ea6', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'9fda882aad59efabf9e2c45a9f1490e87deb323de5aedcf80b4bfbbf1c21f8b0', // Compromised account - fake eDocument task and Teams share credential phishing campaigns
'a0d86d57f426c19a119f6aa3126ffcdc26f86f56d40824896ac168354a8318a5', // Compromised government health service account - BEC purchase order inquiry campaigns
'a0d8f3435d51f1e452dd4cc99f533b718d52f32ceee0e4311fa0b721368b634b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'a18ddb2b10a3a42bbbbc6300dce305703607cf9a12ed737da9f5576b879b1113', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'a25568f7bea934cb12b3a5640e711701fc648b5d329c39f97af299e48f18451c', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'a2bbaa6824197630b7b9fb12296405481f6d2224194559c1ee39a635f8603cfc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'a3e2ac92f5de8d20c54480ab3a61f33be788de8e9467bc18fc5e0b6a0d6da2ed', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'a484fa16fb013b579b1f4006cc42d20da09541271c5f93312b4d02dbeba8385f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'a4f740abf0fa1c0a6c26a9acdff1248e6cd147b392b5806028515ae3da389785', // Attacker-registered domain - fake family office investment solicitation BEC campaigns
'a54656301522393c85cb9f5ff2abb734120f7f957fa5e750730d8966bc2cb4bf', // Compromised Polish school account - fake photo share spam campaigns
'a5e72048f261715f3e7ce6d2cc8916bd2a3e230e5dba3f6bfa3fbf8756ac7381', // Attacker-registered domain - fake family office investment solicitation BEC campaigns
'a61e3cfff46af4b989c3b9ef15fc530d49b02833387503277c25701dc8240ed1', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'a73aa957cd96d7cf65c2933636a5b88a10bd9223f43a493d7d030a67efab3e57', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'a74606dc787d5e75866029b343dd8c08f083d8f9b086362b9fb20f071e79a12b', // Observed malicious sender - BEC/credential phishing campaigns
'a867247b8ccfc2299abe14585264d8a09bc1786f8ca4e2340ebf7c276b0b9af7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'a92c27104a2bd50691964990abd72d2115b676d1f840a27699b9c505290108f7', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'a9f9953ba7510a4ab38bc4602914b2d2aeb2679164494d984ca68b9e1b7d869b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'abd5ceb9b3abbd53544b99ded01b9a993c38b3133b0905d62006f8d378e5f8d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'ac3af7bc7aa52ad34365f7659070dc858ad4eb09aaa9f9177ba37adbdbf60a48', // Observed malicious sender - abused aged domain (SPF none), HR/payroll credphish via encrypted-PDF password lure
'adea82cef2ef6c53647457513d1f0972dcafd4e5ea093a977bbcc8a4ab385d1e', // Compromised account - venture capital partnership request impersonation campaigns
'aee561d4926ae4535a732b4649ea27a5ccef7a18b28775b162d095e11820a52c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b044f948af172622b44fec0affad51861ff32c5f6ba5bcda261293e35a6b5d3b', // Observed malicious sender - advance-fee investment fraud campaigns
'b10df2f1de40412802796ec5895eff9c92880f378aa4f301608cc5dab1fc7515', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b282f3e253bf6a2aa02d484f2edacc2f20338ce37fe157d8817ba96321af6766', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b2dfca515de73047279efe855337aa3c7d6179f7b0d7dc35921fb0377b618baf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b3413ce41fc413b11ba8fd0b58c71e3a811169cc2ac783154eaaf37e84fe7bbe', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b3e89ebfcc45a1fd5f254b8d04c5275d968af4618a7a8c5f6cc75b8d941bd448', // Compromised real account used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b3ed5ef14f1be181d2e375ad4d3d29a3b0777ec5fd162c9c36422962d2dcfd7c', // Observed malicious sender - BEC/credential phishing campaigns
'b45eb5412cc803dec77d6c7abea7ce0e6e3abc72ec75ac19a4f16c9cee65b91b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b4751533eefe4d0cc630fd5dce52e043a1ff6617238b2ebe3b7290899bbe241f', // Observed malicious sender - Kroger brand impersonation credential phishing campaigns
'b53cf0459ca41ca4c51c15d4be23113aeee4d77a77f7f01761e416b6896011b9', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b5a9dd56b5f7bc80c19c1f82b1bceb2d7e8bf42c1edf22346454c7c3a337d399', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b6df58873af5b6edde8f19e46bd7ed10bd0c7b61d4adda29506b05c5f0ef057a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b7281cf68223954ebe25b926a93d4073fa160430de9d90546bde6c34ff1418c5', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'b7415f1380d0a89b124bce7de8b1eee96dc452f9c95252192176cd427020b060', // Observed malicious sender - contract agreement BEC campaigns using freemail reply-to mismatch
'b77161f16370afbd32afd8e613be5ffb1a9d9e99e1b8d3e547cf6379ab55c6ca', // Observed malicious sender - spoofed sender in fake forwarded thread membership invoice fraud campaigns
'b8be174108d56e82b8cb5fe1c47d7bb4ae4fe5a75b76e96e814d730d68200f44', // Compromised account - used in Google Calendar invite credential phishing campaigns
'b8d42ba17d0fe7957537b0d1cf25530bd722f3f998c520d5f148b3cc861cb881', // Observed malicious sender
'bb24567ae519d6391aba7c28597fbf84a1c9b283bcd9e8d9383e4345c7ee0dcf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'be44430a667b7776e351cf54a66f85716de0731dcb1245b7c5bca081e4cd80a5', // Observed malicious sender
'bf5d4be8d2cee2476e9a226bd955f41819e4b01976f9bbd91b58bc82f057d4f6', // Observed malicious sender
'c118eb58bedb809f3d4e2eaed00cc27768f64f155497f7cec47ef57b545bca99', // Compromised account - Japanese company domain used in BEC campaigns
'c319fed85def0d337780b2f93c18fce8aee32421b822a7b1554ff7307a142012', // Compromised account - sales invoice PDF attachment fraud campaigns
'c36ab707c4867b70407bfc0d9a4b069350080fdc820626f9a54f88ca905a3c97', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'c58703f9493a1ba83cfce49fc8afb2fbfc7442ea87abdeb74727a6b21e81d5ec', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'c6d327e24a56cf67283301d3f77f0cdac3e65d8d3f1f611779d92032edfb319a', // Compromised account - agreement finalization e-signature credential phishing campaigns
'c7c688e8204b906d36f4ce1f8bab9238a5eed71d0e5021ac9966c63df027c2bc', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'ca2e7c13010d96bf2286342dc7ea87ec67232e29b5e659820210e01cef273081', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'caed0ffc5a2f2858ef33956eeaf3f1309467e352506dbc200bed299a3ce71420', // Observed malicious sender - advance-fee investment fraud campaigns
'cba8a0af5e7215c47dff6acf2a2e5bd0a52db3b52ba1bb6ced691087bfe5d593', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'ce2be5b5f5f2e6d1d9d8619c832e94cfa804ce4839d834d1af510a769e7a7d16', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'cf75ac0cb2baeaa1bf657101ca7ae0c300398509298f615e3d05fea7216da05c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'cfa974b119ad8212b484a0229914ff1405ca9b8c7489166420986b3576b7da7d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'cfe6deedfb19c2b10e7b4d141a75421e34e846545dcbd4da67ccca4c28336cb2', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'd727d5b6cb6239d9d7a5549862d2fcbafe79efefe8f5f98f91d716a86653c06f', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'd74e6eddf9abd425d77adced3fb56eb96a164b2a56a28e0d75d08ede43d51cd4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'd7a310ef6cb3f4e842b17d268a52391675477f71475b63a4cf1cee6f9bd94ff5', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'd86903bff85599facfd0e178670e77f500fb5fa84ca2aafa20f245c0a6e0aa05', // Observed malicious sender - BEC/credential phishing campaigns
'd8a51f45c253a7032e8192237f8a8a070670f1631c5943a6bbd49dff5fef22a4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'd9a21bdddc5bfebedafb827c71e3d014b64e68c18911e74a298352d7cc1fc552', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'd9b1a194be864f755ad19767c53bfc54dd27fb69464fc9d6b0729f4f82267f42', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'da8c55140d24bc5ea5f26c2712e84166241145cc7e9c950a79a8b7bf474a0200', // Compromised account - Spanish company domain used in credential phishing
'da9493072c014db09e8b4a0d01e179df192799577a99483acc4a6a3af7617fb4', // Compromised Brazilian school student account - fake photo share spam campaigns
'db29e93aaac356acb1ff4fda884fd21809492889fe6af7d0f0a17f1e7ee2d62e', // Observed malicious sender
'db92038c5432edd7ce1df22ae4ffc173eff2ab6f6dc9f77e435b6437d6a788db', // Observed malicious sender - advance-fee project funding fraud from newly registered domain
'dc01b1e4b74adb29a9e2ff4f29a34076f61c87cf04f620cef525d5070818687c', // Observed malicious sender - advance-fee investment fraud campaigns
'e02c4ad389225617a5fe12c012348a928f6c2159b378afb28d4d1f5f1e541376', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'e06aa193933815324af2fee9d3c250dab080a681b9658253ce2b0af0466cbbd1', // Observed malicious sender - advance-fee investment fraud campaigns
'e0da1bd70a04552d8104ae6d11b2eeb477b6dc8ecbd257d5dcde3bec0127044e', // Observed malicious sender - bid solicitation and RFQ vendor impersonation campaigns using typosquatted reply-to domain
'e1509d8bf5ad644ed6eb5eb8cde1c5962ed8a3c18142ee753d24b185705facff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'e1a4513ed83d89a26bd5216b871b8bfda892e5cce47f539a0c04f36e93cc0077', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'e2dd8628371377d56c761817ed6676c5ccd2e9870f1b8cb7b63467f0d387d8fd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'e33298b339846b18124a523b0d065abd21f7f8ca167f0f18a759add3cc06cb93', // Compromised Brazilian company account - BEC wire authorization credential phishing campaigns
'e496f21a9a64bb06d1c3c9f3ce6df5a4fec04e513e51c9d05d6637e48036e9e8', // Observed malicious sender - advance-fee investment fraud campaigns
'e4e85ae5800109afd8bf3d353b16206f3b68cb92447172ca88c317e62a6634a2', // Compromised account - used in Google Calendar invite fake voicemail credential phishing campaigns
'e7c699fb15764decb4193d06537fd56d2ebb7e6af19919dd9b489815c200ea2c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'e8a9768b0450f6383b427808fa6855e617e0f2210cfad339879a25f194aca25d', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'e9c2bed0462383568a1ac0fa73058693c34f06f35293388bc742a6f055d07701', // Compromised account - Google Calendar invite voice message credential phishing campaigns
'ea32f0fb78dd6c1355f2060946aa7ca21d23e7d21c2e726c0077427afe01f25a', // Compromised Turkish manufacturer service account - thread hijacking with credential phishing redirect
'eb6fdf648b34efa0d7eed5ac971d12d2fbc5d8f8fa3c5d3abe7d307b3f1367f2', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'ed227a85dd447f006e6c34ffe955bfbfd864b88e0ef91ddfc1c7f5546bdf6f90', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'eead3a313696ced0b6427ca8b82e7065630e774865142111347f4da4c5634e82', // Compromised account - fake voicemail and remittance notice credential phishing campaigns
'eeb6b71f9c3090dedbd6018df4edeb5d4c86f4819ab0223654ad44c32bac3503', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'f0d099bfdabc2c0ac8f8561a64d66e9e6ee1207fc560db8fe07771fbfa4bdd52', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'f12e13befd897b6b9ea41f1b299200fd71fb5137d6c0866f5af0984ac91a30cf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'f31d0f49475966eea47015c6ef2888a2d8805eef2df40805808ded010183f170', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'f4116dde162ca98aeabba276d40e2d7306b4a63332b67dc994bf9278452a2c60', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'f47441d1d8080fd855a7ebc8ba3549958929f7d2acc70417438319bab03531bf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'f54e3fec312d54805af30d336914a7efc535fab22d057674442434c76702f36f', // Compromised account - fake financial planning report credential phishing campaigns
'f693fc266ddb82491f9b4fd1cfbb727fe8a76713a9f70095dd9ff8452416ab62', // Compromised Puerto Rico nonprofit account - image-based legal subpoena lure targeting accounts payable
'f994c522d9fc5386e1632cff88140e6159efc67021460d7bb798fcf16a396767', // Observed malicious sender
'fa0038a882392e5496003d074ba4f627b377efe20e2cbe8aad9b8547b9222771', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'fa1bdeb8ab383c6be062634d07eacf3611cafcfc43dc0472b20abf13062c7e05', // Compromised account - fake financial planning report credential phishing campaigns
'fa8ac775c0747999f0733c1197e1540b5db9e456a36014347c880b03a3b2aada', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
'fc9c6b86c01d295f937e9a46e385acac640b876d923d2400befeabdd5db3797c', // Compromised account - fake voicemail and remittance notice credential phishing campaigns
'fcbac7976a502038193be95362557c9808746ff4830a570376056340a4087857', // Spoofed legitimate Harvard domain via Amazon SES for BEC/credential phishing campaigns
'fe0327623c71abe970f70c79062ccf66021adcc266fab760ed7d79d65df2221c', // Observed malicious sender - BEC/credential phishing campaigns
'fe08399f0400a0dab9349c6e3ad82bf1a6b70c3578fc519ea330964c918ec210', // Attacker typosquat domain impersonating Fidelity Investments - fake security alerts
'fe766eccc0c02f9ecfb6a9a326a1d77a91a3cee2151680befda2630eb8e128a9', // Observed malicious sender - lookalike law firm domain used in fake insurance policy document campaigns
'fff3c2530f6cc63385b2de940cc3e2c471561a3e5c28f77c650f203f1e86d6f0' // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
)
Playground
Test against your own EMLs or sample data.