Low Severity

Service abuse: Filemail file-sharing notifications

Labels

Malware/Ransomware

BEC/Fraud

Description

Detects legitimate Filemail notification emails abused to deliver file-sharing links, where the reply-to address uses a mismatched domain with a randomized alphanumeric local part, or the notification body references financial lures such as invoices, quotations, purchase orders, or remittance statements. This pattern indicates the free file-sharing service is being leveraged to distribute malicious payloads while evading detection through a trusted sending infrastructure.

References

No references.

Sublime Security

Created Oct 16th, 2026 • Last updated Oct 16th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and sender.email.email == "no-reply@filemail.com"
and (
  any(headers.reply_to,
      .email.domain.root_domain != "filemail.com"
      and regex.imatch(.email.local_part, '[a-z]{3,}\d{3,6}')
  )
  or any(html.xpath(body.html, '//td[span[normalize-space(text())="Subject:"]]').nodes,
         regex.icontains(.display_text,
                         '\b(?:invoice|invoices|estimate|estimates|remittance|statement|statements|purchase order|proforma|billing|payment|receipt|quotation|ach|wire transfer)\b'
         )
  )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.