Detection Method: Header analysis

Header analysis inspects the metadata in message headers to find suspicious patterns, anomalies, or inconsistencies that could indicate phishing, spoofing, or other types of malicious activity. It looks at various header fields like routing information, authentication results, and sender verification data to help spot potential threats.
This includes sender authentication headers like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) results to verify the sender's legitimacy. It also checks how the email traveled through mail servers, looking for any unusual routing that might suggest tampering.
Header analysis can detect:
  • Email spoofing, where attackers forge the sender’s address to appear legitimate
  • Mismatched or inconsistent sender details
  • Suspicious return paths that don’t match the expected sender
  • Unusual routing patterns that stand out from normal email flow
  • Authentication failures that signal potential impersonation attempts
For example, attackers might try to forge email headers to make phishing emails appear as if they’re coming from a trusted source like your bank or your company’s internal email. Header analysis helps you catch these attempts by identifying mismatches between the displayed sender and the actual sending server.
Blog Posts
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Detecting malicious AnonymousFox email messages sent from compromised sites · Blog · Sublime Security
Detecting malicious AnonymousFox email messages sent from compromised sites · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Attack Types (7):
BEC/Fraud
Credential Phishing
Malware/Ransomware
Callback Phishing
Extortion
Spam
Reconnaissance
Tactics & Techniques (24):
Impersonation: Email address
Social engineering
Free email provider
Impersonation: Brand
Lookalike domain
Evasion
Impersonation: Domain
Free subdomain host
Spoofing
Image as content
PDF
Scripting
Free file host
ICS Phishing
Out of band pivot
Impersonation: Employee
Open redirect
HTML smuggling
Impersonation: VIP
QR code
OneNote
Macros
Exploit
Encryption
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Observed IOC: Malicious sender email addresses
1d ago
May 29th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
Credential phishing: Engaging language and other indicators (untrusted sender)
1d ago
May 29th, 2026
Sublime Security
Credential Phishing
Free email provider
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
URL analysis
Reconnaissance: Short generic greeting message
1d ago
May 29th, 2026
Sublime Security
BEC/Fraud
Callback Phishing
Social engineering
Free email provider
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Meta and subsidiaries
1d ago
May 29th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Header analysis
Sender analysis
Body: HTML whitespace stuffing with short initial message
1d ago
May 29th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Content analysis
HTML analysis
Header analysis
Credential phishing: Suspicious e-sign agreement document notification
1d ago
May 29th, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Header analysis
HTML analysis
URL analysis
Sender analysis
Service Abuse: HelloSign share with suspicious sender or document name
2d ago
May 28th, 2026
Sublime Security
Callback Phishing
BEC/Fraud
Evasion
Social engineering
Sender analysis
Header analysis
Content analysis
Link: Self-sender credential theft with configuration placeholder
3d ago
May 27th, 2026
Sublime Security
Credential Phishing
Social engineering
Evasion
Natural Language Understanding
Content analysis
URL analysis
Header analysis
Observed IOC: Malicious sender domains
3d ago
May 27th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
Brand impersonation: DHL
4d ago
May 26th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Header analysis
Sender analysis
Brand impersonation: Dashlane
4d ago
May 26th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Header analysis
Sender analysis
Credential phishing: Onedrive impersonation
4d ago
May 26th, 2026
Sublime Security
Credential Phishing
Free subdomain host
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Natural Language Understanding
URL analysis
Brand Impersonation: PayPal
9d ago
May 21st, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Computer Vision
Content analysis
File analysis
Header analysis
Sender analysis
Headers: X-Source-Auth mismatch with mismatched reply-to domain
9d ago
May 21st, 2026
Sublime Security
BEC/Fraud
Social engineering
Spoofing
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Impersonation: Legal firm with copyright infringement notice
9d ago
May 21st, 2026
Sublime Security
BEC/Fraud
Extortion
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Sender analysis
Brand impersonation: Quickbooks
10d ago
May 20th, 2026
Sublime Security
Callback Phishing
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
Extortion / sextortion (untrusted sender)
10d ago
May 20th, 2026
Sublime Security
Extortion
Social engineering
Spoofing
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Robinhood
11d ago
May 19th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Sender analysis
URL analysis
Fake thread with suspicious indicators
11d ago
May 19th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Spam
Evasion
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Advance Fee Fraud (AFF) from freemail provider or suspicious TLD
12d ago
May 18th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Page 1 of 20