Detection Method: Header analysis

Header analysis inspects the metadata in message headers to find suspicious patterns, anomalies, or inconsistencies that could indicate phishing, spoofing, or other types of malicious activity. It looks at various header fields like routing information, authentication results, and sender verification data to help spot potential threats.
This includes sender authentication headers like SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) results to verify the sender's legitimacy. It also checks how the email traveled through mail servers, looking for any unusual routing that might suggest tampering.
Header analysis can detect:
  • Email spoofing, where attackers forge the sender’s address to appear legitimate
  • Mismatched or inconsistent sender details
  • Suspicious return paths that don’t match the expected sender
  • Unusual routing patterns that stand out from normal email flow
  • Authentication failures that signal potential impersonation attempts
For example, attackers might try to forge email headers to make phishing emails appear as if they’re coming from a trusted source like your bank or your company’s internal email. Header analysis helps you catch these attempts by identifying mismatches between the displayed sender and the actual sending server.
Blog Posts
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Detecting malicious AnonymousFox email messages sent from compromised sites · Blog · Sublime Security
Detecting malicious AnonymousFox email messages sent from compromised sites · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
QR Code Phishing: Decoding Hidden Threats · Blog · Sublime Security
Attack Types (7):
Credential Phishing
BEC/Fraud
Malware/Ransomware
Spam
Extortion
Callback Phishing
Reconnaissance
Tactics & Techniques (20):
Impersonation: Brand
Social engineering
Evasion
Free email provider
Impersonation: Employee
Spoofing
Impersonation: VIP
Free file host
Image as content
PDF
Lookalike domain
HTML smuggling
Free subdomain host
QR code
Scripting
Out of band pivot
Exploit
Open redirect
OneNote
Macros
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: Google Careers
2h ago
Nov 12th, 2025
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/brand-impersonation-google-careers-cf2d97ad
VIP Impersonation via Google Group relay with suspicious indicators
3h ago
Nov 12th, 2025
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Evasion
Free email provider
Impersonation: Employee
Social engineering
Spoofing
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/vip-impersonation-via-google-group-relay-with-suspicious-indicators-57f9cd3b
Fake message thread with a suspicious link and engaging language from an unknown sender
3h ago
Nov 12th, 2025
Sublime Security
Credential Phishing
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
URL analysis
/feeds/core/detection-rules/fake-message-thread-with-a-suspicious-link-and-engaging-language-from-an-unknown-sender-8fd0e211
VIP impersonation with charitable donation fraud
3h ago
Nov 12th, 2025
Sublime Security
BEC/Fraud
Impersonation: Employee
Impersonation: VIP
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/vip-impersonation-with-charitable-donation-fraud-35a56b8e
Service Abuse: ExactTarget with suspicious sender indicators
4d ago
Nov 8th, 2025
Sublime Security
Credential Phishing
BEC/Fraud
Evasion
Social engineering
Header analysis
Sender analysis
/feeds/core/detection-rules/service-abuse-exacttarget-with-suspicious-sender-indicators-6154f197
Brand impersonation: Survey request with credential theft indicators
4d ago
Nov 8th, 2025
Sublime Security
Credential Phishing
Social engineering
Impersonation: Brand
Spoofing
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/brand-impersonation-survey-request-with-credential-theft-indicators-ea1c0e09
Brand impersonation: Microsoft with low reputation links
4d ago
Nov 8th, 2025
Sublime Security
Credential Phishing
Free file host
Image as content
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
File analysis
Header analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
URL analysis
/feeds/core/detection-rules/brand-impersonation-microsoft-with-low-reputation-links-b59201b6
Credential phishing: Suspicious e-sign agreement document notification
5d ago
Nov 7th, 2025
Sublime Security
Credential Phishing
Social engineering
Content analysis
Header analysis
HTML analysis
URL analysis
Sender analysis
/feeds/core/detection-rules/credential-phishing-suspicious-e-sign-agreement-document-notification-9b68c2d8
Brand impersonation: SharePoint PDF attachment with credential theft language
5d ago
Nov 7th, 2025
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
PDF
Evasion
Computer Vision
File analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
URL analysis
Header analysis
Whois
/feeds/core/detection-rules/brand-impersonation-sharepoint-pdf-attachment-with-credential-theft-language-ae3756fa
Brand impersonation: SendGrid
5d ago
Nov 7th, 2025
Sublime Security
BEC/Fraud
Credential Phishing
Spam
Impersonation: Brand
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
/feeds/core/detection-rules/brand-impersonation-sendgrid-d800124f
Brand impersonation: Paperless Post
6d ago
Nov 6th, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
Impersonation: Brand
Content analysis
Header analysis
HTML analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/brand-impersonation-paperless-post-e9ec5e09
Headers: Outlook Express mailer
6d ago
Nov 6th, 2025
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Evasion
Spoofing
Header analysis
/feeds/core/detection-rules/headers-outlook-express-mailer-b7a698de
Spam: Mastercard promotional content with image-based body
7d ago
Nov 5th, 2025
Sublime Security
Credential Phishing
Spam
Image as content
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Header analysis
Natural Language Understanding
Optical Character Recognition
Sender analysis
/feeds/core/detection-rules/spam-mastercard-promotional-content-with-image-based-body-5f2cb559
Brand impersonation: Coinbase
8d ago
Nov 4th, 2025
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Header analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-coinbase-3dca757a
Brand impersonation: Amazon
8d ago
Nov 4th, 2025
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Header analysis
Sender analysis
/feeds/core/detection-rules/brand-impersonation-amazon-13fc967d
Attachment: EML file contains HTML attachment with login portal indicators
8d ago
Nov 4th, 2025
Sublime Security
Credential Phishing
Evasion
HTML smuggling
Content analysis
File analysis
Header analysis
HTML analysis
Javascript analysis
Sender analysis
/feeds/core/detection-rules/attachment-eml-file-contains-html-attachment-with-login-portal-indicators-6e4df158
ClickFunnels link infrastructure abuse
8d ago
Nov 4th, 2025
Sublime Security
Credential Phishing
Free email provider
Free subdomain host
Social engineering
Content analysis
Header analysis
QR code analysis
Sender analysis
URL analysis
/feeds/core/detection-rules/clickfunnels-link-infrastructure-abuse-9192fbe9
Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender
8d ago
Nov 4th, 2025
Sublime Security
Credential Phishing
Evasion
Social engineering
File analysis
Header analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/attachment-rfc822-containing-suspicious-file-sharing-language-with-links-from-untrusted-sender-d96854d7
Impersonation: Internal corporate services
8d ago
Nov 4th, 2025
Sublime Security
Credential Phishing
Impersonation: Employee
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
/feeds/core/detection-rules/impersonation-internal-corporate-services-3cd04f33
Spam: Personalized subject and greetings via Salesforce Marketing Cloud
9d ago
Nov 3rd, 2025
Sublime Security
Spam
Social engineering
Content analysis
Header analysis
/feeds/core/detection-rules/spam-personalized-subject-and-greetings-via-salesforce-marketing-cloud-c77f127f
Page 1 of 16