Low Severity
Suspicious mailer received from Gmail servers
Description
Mailer is atypical of sends from Gmail infrastructure. Observed sending callback phishing and general spam.
References
No references.
Sublime Security
Created Sep 12th, 2024 • Last updated Jul 16th, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
and (
strings.ilike(headers.mailer,
"Microsoft CDO for Windows 2000",
"PHPMailer*",
"nodemailer*"
)
or any(headers.hops, any(.fields, .value == "Produced By Microsoft MimeOLE"))
)
and (
any(headers.hops, .index == 0 and .received.server.raw == "smtp.gmail.com")
or headers.return_path.domain.root_domain in ("gmail.com", "googlemail.com")
)
and not profile.by_sender().any_messages_benign
Playground
Test against your own EMLs or sample data.