• Sublime Core Feed
Low Severity

Suspicious mailer received from Gmail servers

Labels

Callback Phishing
Spam
Free email provider
Social engineering
Header analysis

Description

Mailer is atypical of sends from Gmail infrastructure. Observed sending callback phishing and general spam.

References

No references.

Sublime Security
Created Sep 12th, 2024 • Last updated Jul 16th, 2025
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and (
  strings.ilike(headers.mailer,
                "Microsoft CDO for Windows 2000",
                "PHPMailer*",
                "nodemailer*"
  )
  or any(headers.hops, any(.fields, .value == "Produced By Microsoft MimeOLE"))
)
and (
  any(headers.hops, .index == 0 and .received.server.raw == "smtp.gmail.com")
  or headers.return_path.domain.root_domain in ("gmail.com", "googlemail.com")
)
and not profile.by_sender().any_messages_benign
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started