Medium Severity

Subject: Hex-encoded recipient address in subject

Labels

Credential Phishing
Evasion
Encryption
Content analysis
Header analysis

Description

Flags inbound messages where the subject line contains a long hexadecimal string that, when decoded, matches the recipient's email address. This technique is commonly used to personalize or track delivery of bulk unsolicited messages while obscuring the encoded data from simple string matching.

References

No references.

Sublime Security
Created Nov 3rd, 2026 • Last updated Nov 3rd, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(regex.iextract(subject.base, '[0-9a-f]{20,}'),
        strings.decode_hex(.full_match) in map(recipients.to, .email.email)
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started