• Sublime Core Feed
Low Severity

Subject and sender display name contains matching long alphanumeric string

Labels

Malware/Ransomware
Credential Phishing
Evasion
Social engineering
Content analysis
Header analysis
Sender analysis

Description

Detects messages where both the subject line and sender display name contain identical alphanumeric strings that are between 32 and 64 characters, which may indicate automated generation or coordination between these fields for malicious purposes.

References

No references.

Sublime Security
Created Dec 8th, 2025 • Last updated Jan 12th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(regex.iextract(subject.subject,
                       '[^a-z0-9](?P<string>[a-z0-9]{32,64})(?:$|[^a-z0-9])'
        ),
        strings.contains(sender.display_name, .named_groups["string"])
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started