Detection Method: Sender analysis

Sender analysis helps you assess whether an email is coming from a legitimate sender. By combining machine learning and rules-based logic, this method evaluates sender profiles, looking at things like authentication results, past behavior, and patterns from previous messages.
Sender analysis can help you detect:
  • Impersonation attempts using fake email addresses or domains
  • Suspicious senders with authentication issues (e.g., SPF, DKIM, DMARC failures)
  • Unusual behavior based on historical patterns, like frequent urgent requests
  • Senders linked to known phishing or malware campaigns
  • Changes in sender behavior that could indicate a compromised account
For example, an attacker might try to impersonate a trusted vendor or executive. The email address or domain might look real, but sender analysis can catch issues like failed authentication checks or past suspicious activity, helping you spot these threats before they do damage.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Suspicious message with unscannable Cloudflare link
2h ago
Aug 12th, 2026
Sublime Security
Brand impersonation: USPS
1d ago
Aug 11th, 2026
Sublime Security
Brand impersonation: Meta and subsidiaries
1d ago
Aug 11th, 2026
Sublime Security
Brand impersonation: Netflix
1d ago
Aug 11th, 2026
min0k
Business Email Compromise (BEC) with request for mobile number
1d ago
Aug 11th, 2026
Sublime Security
BEC/Fraud: Fake investment outreach from suspicious TLD
1d ago
Aug 11th, 2026
Sublime Security
Brand impersonation: Social Security Administration
1d ago
Aug 11th, 2026
Sublime Security
Extortion / sextortion (untrusted sender)
1d ago
Aug 11th, 2026
Sublime Security
VIP impersonation: Fake thread with VIPs missing email metadata
1d ago
Aug 11th, 2026
Sublime Security
VIP impersonation: VIP payment redirect handoff via fake threads
2d ago
Aug 10th, 2026
Sublime Security
VIP impersonation: Invoice fraud with mobile device sign-off
2d ago
Aug 10th, 2026
Sublime Security
Observed IOC: Mail transiting bulletproof host - SmartApe
2d ago
Aug 10th, 2026
Sublime Security
VIP impersonation: Payment handoff with VIP display name authored fake threads
2d ago
Aug 10th, 2026
Sublime Security
Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group
2d ago
Aug 10th, 2026
Sublime Security
New link domain (<=10d) from untrusted sender
2d ago
Aug 10th, 2026
Sublime Security
Brand impersonation: LinkedIn
5d ago
Aug 7th, 2026
Sublime Security
Observed IOC: Malicious sender domains
5d ago
Aug 7th, 2026
Sublime Security
Brand Impersonation: PayPal
5d ago
Aug 7th, 2026
Sublime Security
Credential phishing: Generic document sharing
5d ago
Aug 7th, 2026
Sublime Security
Observed IOC: Malicious sender email addresses
5d ago
Aug 7th, 2026
Sublime Security