Detection Method: Header analysis

Header analysis inspects the metadata in message headers to find suspicious patterns, anomalies, or inconsistencies that could indicate phishing, spoofing, or other types of malicious activity. It looks at various header fields like routing information, authentication results, and sender verification data to help spot potential threats.
This includes sender authentication headers like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) results to verify the sender's legitimacy. It also checks how the email traveled through mail servers, looking for any unusual routing that might suggest tampering.
Header analysis can detect:
  • Email spoofing, where attackers forge the sender’s address to appear legitimate
  • Mismatched or inconsistent sender details
  • Suspicious return paths that don’t match the expected sender
  • Unusual routing patterns that stand out from normal email flow
  • Authentication failures that signal potential impersonation attempts
For example, attackers might try to forge email headers to make phishing emails appear as if they’re coming from a trusted source like your bank or your company’s internal email. Header analysis helps you catch these attempts by identifying mismatches between the displayed sender and the actual sending server.
Blog Posts
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Detecting malicious AnonymousFox email messages sent from compromised sites · Blog · Sublime Security
Detecting malicious AnonymousFox email messages sent from compromised sites · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Attack Types (7):
BEC/Fraud
Credential Phishing
Malware/Ransomware
Spam
Callback Phishing
Extortion
Reconnaissance
Tactics & Techniques (24):
Impersonation: Domain
Social engineering
Impersonation: Email address
Evasion
Free file host
Free subdomain host
Impersonation: Brand
Free email provider
Spoofing
Lookalike domain
Image as content
HTML smuggling
Impersonation: Employee
Open redirect
Impersonation: VIP
Macros
Out of band pivot
PDF
Scripting
ICS Phishing
QR code
OneNote
Exploit
Encryption
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Observed IOC: Malicious sender domains
3d ago
Jun 19th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
Observed IOC: Malicious sender email addresses
3d ago
Jun 19th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
Service abuse: DocSend share from an unsolicited reply-to address
4d ago
Jun 18th, 2026
Sublime Security
Credential Phishing
Evasion
Free file host
Social engineering
Content analysis
Header analysis
Sender analysis
Service abuse: Google Firebase sender address with suspicious content
4d ago
Jun 18th, 2026
Sublime Security
Spam
Credential Phishing
Free subdomain host
Social engineering
Content analysis
Header analysis
HTML analysis
Natural Language Understanding
Sender analysis
URL analysis
Whois
Service abuse: Outlook Groups with Google Sites link and evasion tag
5d ago
Jun 17th, 2026
Sublime Security
Credential Phishing
Evasion
Free subdomain host
Social engineering
Content analysis
Header analysis
URL analysis
Sender analysis
Brand impersonation: Quickbooks
5d ago
Jun 17th, 2026
Sublime Security
Callback Phishing
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
Link: Romance/Sexual Language With Suspicious Link
5d ago
Jun 17th, 2026
Sublime Security
Spam
Social engineering
Content analysis
Header analysis
URL analysis
Whois
Fake thread with suspicious indicators
5d ago
Jun 17th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Spam
Evasion
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Reconnaissance: Short generic greeting message
5d ago
Jun 17th, 2026
Sublime Security
BEC/Fraud
Callback Phishing
Social engineering
Free email provider
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Survey request with credential theft indicators
5d ago
Jun 17th, 2026
Sublime Security
Credential Phishing
Social engineering
Impersonation: Brand
Spoofing
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Self-impersonation: Sender matches recipient with bolded name and suspicious link
6d ago
Jun 16th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Header analysis
HTML analysis
Sender analysis
Fake Zoom meeting invite with suspicious link
6d ago
Jun 16th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Evasion
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
URL analysis
BEC/Fraud: Fake investment outreach from suspicious TLD
7d ago
Jun 15th, 2026
Sublime Security
BEC/Fraud
Social engineering
Header analysis
Sender analysis
Content analysis
Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
7d ago
Jun 15th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Observed IOC: Malicious sender root domains
10d ago
Jun 12th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
Scam soliciting employer review/rating
10d ago
Jun 12th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Social engineering
Impersonation: Brand
Content analysis
Natural Language Understanding
Header analysis
Sender analysis
Brand impersonation: QuickBooks dispute notification
12d ago
Jun 10th, 2026
Sublime Security
BEC/Fraud
Impersonation: Brand
Content analysis
Sender analysis
Header analysis
Brand impersonation: Adobe Sign with suspicious indicators
12d ago
Jun 10th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Header analysis
HTML analysis
Sender analysis
Brand impersonation: Canada Revenue Agency
14d ago
Jun 8th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Sender analysis
Brand impersonation: Blockchain.com
17d ago
Jun 5th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Header analysis
Sender analysis
Page 1 of 20