Sublime Security

Sublime Core Feed
HTML analysis
Learn More
Login to Sublime
Attack Types
BEC/Fraud
Callback Phishing
Credential Phishing
Extortion
Malware/Ransomware
Reconnaissance
Spam
Tactics and Techniques
Encryption
Evasion
Exploit
Free email provider
Free file host
Free subdomain host
HTML smuggling
ICS Phishing
Image as content
Impersonation: Brand
Impersonation: Employee
Impersonation: VIP
IPFS
ISO
LNK
Lookalike domain
Macros
OneNote
Open redirect
Out of band pivot
PDF
Punycode
QR code
Scripting
Social engineering
Spoofing
Detection Methods
Archive analysis
Content analysis
Computer Vision
Exif analysis
File analysis
Header analysis
HTML analysis
Javascript analysis
Macro analysis
Natural Language Understanding
Optical Character Recognition
OLE analysis
PDF analysis
QR code analysis
Sender analysis
Threat intelligence
URL analysis
URL screenshot
Whois
XML analysis
YARA
Detection Method: HTML analysis
HTML analysis looks at the HTML code in emails, web pages, or attachments to spot potentially malicious elements or deceptive structures. It examines both what’s visible and hidden in the HTML to uncover tactics often used in phishing or malware attacks.
HTML analysis can help you detect:
Hidden scripts or iframes that might run harmful code
Obfuscated JavaScript designed to avoid detection
Misleading hyperlinks where the displayed text doesn’t match the real URL
Forms made to steal credentials or sensitive data
Suspicious HTML comments with hidden instructions
CSS tricks used to hide malicious content
For example, phishing emails often use HTML to replicate trusted login pages. HTML analysis can catch the hidden forms and scripts trying to steal your credentials.
Blog Posts
Talking phish over turkey · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Call Me Maybe? The Rise of Callback Phishing Emails · Blog · Sublime Security
Attack Types (6):
Callback Phishing
Credential Phishing
BEC/Fraud
Spam
Malware/Ransomware
Extortion
Tactics & Techniques (23):
Social engineering
Impersonation: Brand
Free file host
Free subdomain host
Impersonation: VIP
Evasion
Scripting
Spoofing
Free email provider
HTML smuggling
Image as content
Open redirect
Out of band pivot
ICS Phishing
Exploit
PDF
Lookalike domain
Credential Phishing
Encryption
HTML injection
Impersonation: Employee
OneNote
ISO
Rule Name & Severity
Last Updated
Types, Tactics & Capabilities
Service abuse: Oracle Cloud Workflow callback scam
6d ago
Jul 10th, 2026
Sublime Security
Callback Phishing
Social engineering
Impersonation: Brand
Sender analysis
HTML analysis
Natural Language Understanding
Callback Phishing
Social engineering
Impersonation: Brand
Sender analysis
HTML analysis
Natural Language Understanding
Credential phishing: Blue button styled link with file-sharing template artifacts
8d ago
Jul 8th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
HTML analysis
URL analysis
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
HTML analysis
URL analysis
Service abuse: SurveyMonkey with suspicious outbound links
8d ago
Jul 8th, 2026
Sublime Security
Credential Phishing
Social engineering
Impersonation: Brand
Content analysis
HTML analysis
Sender analysis
URL analysis
Credential Phishing
Social engineering
Impersonation: Brand
Content analysis
HTML analysis
Sender analysis
URL analysis
Zoom Events newsletter abuse
8d ago
Jul 8th, 2026
Sublime Security
Credential Phishing
Free file host
Free subdomain host
Social engineering
Impersonation: Brand
Header analysis
HTML analysis
Natural Language Understanding
URL analysis
Credential Phishing
Free file host
Free subdomain host
Social engineering
Impersonation: Brand
Header analysis
HTML analysis
Natural Language Understanding
URL analysis
VIP impersonation: VIP recipient of previous thread with HTML generator
9d ago
Jul 7th, 2026
Sublime Security
BEC/Fraud
Impersonation: VIP
Social engineering
Evasion
HTML analysis
Content analysis
Sender analysis
BEC/Fraud
Impersonation: VIP
Social engineering
Evasion
HTML analysis
Content analysis
Sender analysis
BEC: Executive coaching vendor impersonation
15d ago
Jul 1st, 2026
Sublime Security
BEC/Fraud
Impersonation: Brand
Social engineering
Content analysis
HTML analysis
Natural Language Understanding
BEC/Fraud
Impersonation: Brand
Social engineering
Content analysis
HTML analysis
Natural Language Understanding
HTML: Template placeholders or recipient email in element class attributes
16d ago
Jun 30th, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Evasion
Social engineering
HTML analysis
Content analysis
Credential Phishing
BEC/Fraud
Evasion
Social engineering
HTML analysis
Content analysis
Credential theft: JavaScript date manipulation in HTML body
17d ago
Jun 29th, 2026
Sublime Security
Credential Phishing
Evasion
Scripting
Social engineering
HTML analysis
Javascript analysis
Natural Language Understanding
Credential Phishing
Evasion
Scripting
Social engineering
HTML analysis
Javascript analysis
Natural Language Understanding
Link: Suspicious single-domain link with suspicious path and financial lure indicators
20d ago
Jun 26th, 2026
Sublime Security
Spam
Social engineering
Content analysis
HTML analysis
URL analysis
Spam
Social engineering
Content analysis
HTML analysis
URL analysis
Brand impersonation: Microsoft Teams invitation
20d ago
Jun 26th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Header analysis
HTML analysis
URL analysis
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Header analysis
HTML analysis
URL analysis
Link: Fake secure message notification template
21d ago
Jun 25th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
HTML analysis
Content analysis
URL analysis
Credential Phishing
Evasion
Social engineering
HTML analysis
Content analysis
URL analysis
Body: Invisible Unicode obfuscation student loan callback phishing
21d ago
Jun 25th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Spam
Evasion
Social engineering
HTML analysis
Content analysis
BEC/Fraud
Credential Phishing
Spam
Evasion
Social engineering
HTML analysis
Content analysis
Body: Suspicious table template fingerprint
21d ago
Jun 25th, 2026
Sublime Security
Credential Phishing
Social engineering
Evasion
HTML analysis
Content analysis
Credential Phishing
Social engineering
Evasion
HTML analysis
Content analysis
Body: Fake secure email portal with HTML obfuscation
28d ago
Jun 18th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Spoofing
Content analysis
HTML analysis
URL analysis
Sender analysis
Threat intelligence
Credential Phishing
Evasion
Social engineering
Spoofing
Content analysis
HTML analysis
URL analysis
Sender analysis
Threat intelligence
Service abuse: Google Firebase sender address with suspicious content
28d ago
Jun 18th, 2026
Sublime Security
Spam
Credential Phishing
Free subdomain host
Social engineering
Content analysis
Header analysis
HTML analysis
Natural Language Understanding
Sender analysis
URL analysis
Whois
Spam
Credential Phishing
Free subdomain host
Social engineering
Content analysis
Header analysis
HTML analysis
Natural Language Understanding
Sender analysis
URL analysis
Whois
Evasion: Hidden content divs from freemail sender
29d ago
Jun 17th, 2026
Sublime Security
Credential Phishing
Evasion
Free email provider
HTML analysis
Content analysis
Sender analysis
Credential Phishing
Evasion
Free email provider
HTML analysis
Content analysis
Sender analysis
Self-impersonation: Sender matches recipient with bolded name and suspicious link
30d ago
Jun 16th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Header analysis
HTML analysis
Sender analysis
Credential Phishing
Evasion
Social engineering
Header analysis
HTML analysis
Sender analysis
Impersonation: Fake product discount promotion
30d ago
Jun 16th, 2026
Sublime Security
BEC/Fraud
Social engineering
Free file host
Content analysis
HTML analysis
URL analysis
BEC/Fraud
Social engineering
Free file host
Content analysis
HTML analysis
URL analysis
HTML content with print styling and credential theft language
30d ago
Jun 16th, 2026
Sublime Security
Credential Phishing
Evasion
HTML smuggling
Social engineering
Content analysis
HTML analysis
Natural Language Understanding
Credential Phishing
Evasion
HTML smuggling
Social engineering
Content analysis
HTML analysis
Natural Language Understanding
Body: Yellow highlighted text markers
30d ago
Jun 16th, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Evasion
HTML analysis
Content analysis
Credential Phishing
BEC/Fraud
Evasion
HTML analysis
Content analysis
Page 1 of 7

Rule Name & Severity	Last Updated	Author	Types, Tactics & Capabilities
Service abuse: Oracle Cloud Workflow callback scam	6d ago Jul 10th, 2026	Sublime Security	Callback Phishing Social engineering Impersonation: Brand Sender analysis HTML analysis Natural Language Understanding
Credential phishing: Blue button styled link with file-sharing template artifacts	8d ago Jul 8th, 2026	Sublime Security	Credential Phishing Impersonation: Brand Social engineering Content analysis HTML analysis URL analysis
Service abuse: SurveyMonkey with suspicious outbound links	8d ago Jul 8th, 2026	Sublime Security	Credential Phishing Social engineering Impersonation: Brand Content analysis HTML analysis Sender analysis URL analysis
Zoom Events newsletter abuse	8d ago Jul 8th, 2026	Sublime Security	Credential Phishing Free file host Free subdomain host Social engineering Impersonation: Brand Header analysis HTML analysis Natural Language Understanding URL analysis
VIP impersonation: VIP recipient of previous thread with HTML generator	9d ago Jul 7th, 2026	Sublime Security	BEC/Fraud Impersonation: VIP Social engineering Evasion HTML analysis Content analysis Sender analysis
BEC: Executive coaching vendor impersonation	15d ago Jul 1st, 2026	Sublime Security	BEC/Fraud Impersonation: Brand Social engineering Content analysis HTML analysis Natural Language Understanding
HTML: Template placeholders or recipient email in element class attributes	16d ago Jun 30th, 2026	Sublime Security	Credential Phishing BEC/Fraud Evasion Social engineering HTML analysis Content analysis
Credential theft: JavaScript date manipulation in HTML body	17d ago Jun 29th, 2026	Sublime Security	Credential Phishing Evasion Scripting Social engineering HTML analysis Javascript analysis Natural Language Understanding
Link: Suspicious single-domain link with suspicious path and financial lure indicators	20d ago Jun 26th, 2026	Sublime Security	Spam Social engineering Content analysis HTML analysis URL analysis
Brand impersonation: Microsoft Teams invitation	20d ago Jun 26th, 2026	Sublime Security	Credential Phishing Impersonation: Brand Social engineering Content analysis Header analysis HTML analysis URL analysis
Link: Fake secure message notification template	21d ago Jun 25th, 2026	Sublime Security	Credential Phishing Evasion Social engineering HTML analysis Content analysis URL analysis
Body: Invisible Unicode obfuscation student loan callback phishing	21d ago Jun 25th, 2026	Sublime Security	BEC/Fraud Credential Phishing Spam Evasion Social engineering HTML analysis Content analysis
Body: Suspicious table template fingerprint	21d ago Jun 25th, 2026	Sublime Security	Credential Phishing Social engineering Evasion HTML analysis Content analysis
Body: Fake secure email portal with HTML obfuscation	28d ago Jun 18th, 2026	Sublime Security	Credential Phishing Evasion Social engineering Spoofing Content analysis HTML analysis URL analysis Sender analysis Threat intelligence
Service abuse: Google Firebase sender address with suspicious content	28d ago Jun 18th, 2026	Sublime Security	Spam Credential Phishing Free subdomain host Social engineering Content analysis Header analysis HTML analysis Natural Language Understanding Sender analysis URL analysis Whois
Evasion: Hidden content divs from freemail sender	29d ago Jun 17th, 2026	Sublime Security	Credential Phishing Evasion Free email provider HTML analysis Content analysis Sender analysis
Self-impersonation: Sender matches recipient with bolded name and suspicious link	30d ago Jun 16th, 2026	Sublime Security	Credential Phishing Evasion Social engineering Header analysis HTML analysis Sender analysis
Impersonation: Fake product discount promotion	30d ago Jun 16th, 2026	Sublime Security	BEC/Fraud Social engineering Free file host Content analysis HTML analysis URL analysis
HTML content with print styling and credential theft language	30d ago Jun 16th, 2026	Sublime Security	Credential Phishing Evasion HTML smuggling Social engineering Content analysis HTML analysis Natural Language Understanding
Body: Yellow highlighted text markers	30d ago Jun 16th, 2026	Sublime Security	Credential Phishing BEC/Fraud Evasion HTML analysis Content analysis