Observed IOC: Malicious sender root domains

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.domain.root_domain) in (
  '0d5c8fb81fbe42f919341fc80f73437d1077d70f9da986e5719bd68274b42626', // Brand impersonation giveaways with AFF
  '3e09e73578196179a054606834b0cd7172a619f5e4702f2424dfbd0ab4d79786', // Brand impersonation giveaways with AFF
  '4460762dd04ddb87f23a8b47ffb7190d24fc3e36990f990589e93a8fc706ef16', // Attacker-controlled domain - Wix and registrar impersonation domain renewal credential phishing from rotating local parts
  '48e4bf2fd8bd7c31e22ab2f44156457c3f5aeb861540b479341ab8982e7c5271', // Attacker-controlled domain - Credential phishing and fake document notifications sent via Amazon SES from rotating no-reply local parts
  '62241b7477485898cdb45d9814693e9cb4989ee7bd65c2c3e205a91b84cf3fec', // Brand impersonation giveaways with AFF
  '674b7cb4df4d9e115dd57ad0eb8227f6bb7719ef596c17a7443883718632c6ff', // Brand impersonation giveaways with AFF
  '724eba9594f52e2aeaed2e58926f8c52048accc44a15ecc0bdb5a0a101dbc268', // Brand impersonation giveaways with AFF
  '91d0721e7cf3646224f8e95f6b5582b83a13c483eb56423bfb585af6392df11b', // Brand impersonation giveaways with AFF
  '9d99b871bd0509fa8df745dda56f6f69df0a0687bec41e70050e6b1637954d3f', // Attacker-controlled domain - Registrar suspension notice credential phishing from rotating local parts
  'a40015c5fe61ff49ad076af6ad2e48ec1a46546903b6cb2b80047ee4a72f4c8e', // Brand impersonation - Google Authenticator lookalike sending fake 2FA codes and new sign-in alerts
  'a8c8b0ee7c69c310e54d8710c3575a9e1de9a2950e6ed1806c1fe60e6cb63d36', // Brand impersonation giveaways with AFF
  'ae7ef98abc59eabb4d6ee22444c16d791f49505ea657c37f4ff5846b273cb30d', // Brand impersonation giveaways with AFF
  'c4c2e8a023cd5534ed1b261296f0174faf498924facf3e75c36e4a5820a14b0f', // Attacker-controlled lookalike domain - Okta MFA reset credential phishing
  'e1bbb6342ed70324f41fd3b3e5f6694f28af4aa24bac67b6634daecf18acbc78', // Brand impersonation giveaways with AFF
  'e4beaafe95cdcf3d596eefa2006e77eb826efae12a693fdf83c6c8c43d92c29f' // Brand impersonation giveaways with AFF
)