• Sublime Core Feed
High Severity

Service abuse: HungerRush domain with SendGrid tracking targeting ProtonMail

Description

Detects inbound messages from hungerrush.com domain that contain SendGrid tracking pixels and reference redacted ProtonMail addresses, indicating potential abuse of legitimate services for suspicious targeting.

References

No references.

Sublime Security
Created Mar 4th, 2026 • Last updated Mar 4th, 2026
Source
type.inbound
and sender.email.domain.root_domain == "hungerrush.com"
// html contains sendgrid open tracking pixel
and strings.icontains(body.html.raw, 'sendgrid.net/wf/open')
// body contains "redacted" proton email address
and regex.icontains(body.current_thread.text, '(?:\*\*|protonmail\.com)')
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started