Sublime Security

Sublime Core Feed
Sender analysis
Learn More
Login to Sublime
Attack Types
BEC/Fraud
Callback Phishing
Credential Phishing
Extortion
Malware/Ransomware
Reconnaissance
Spam
Tactics and Techniques
Encryption
Evasion
Exploit
Free email provider
Free file host
Free subdomain host
HTML smuggling
ICS Phishing
Image as content
Impersonation: Brand
Impersonation: Employee
Impersonation: VIP
IPFS
ISO
LNK
Lookalike domain
Macros
OneNote
Open redirect
Out of band pivot
PDF
Punycode
QR code
Scripting
Social engineering
Spoofing
Detection Methods
Archive analysis
Content analysis
Computer Vision
Exif analysis
File analysis
Header analysis
HTML analysis
Javascript analysis
Macro analysis
Natural Language Understanding
Optical Character Recognition
OLE analysis
PDF analysis
QR code analysis
Sender analysis
Threat intelligence
URL analysis
URL screenshot
Whois
XML analysis
YARA
Detection Method: Sender analysis
Sender analysis helps you assess whether an email is coming from a legitimate sender. By combining machine learning and rules-based logic, this method evaluates sender profiles, looking at things like authentication results, past behavior, and patterns from previous messages.
Sender analysis can help you detect:
Impersonation attempts using fake email addresses or domains
Suspicious senders with authentication issues (e.g., SPF, DKIM, DMARC failures)
Unusual behavior based on historical patterns, like frequent urgent requests
Senders linked to known phishing or malware campaigns
Changes in sender behavior that could indicate a compromised account
For example, an attacker might try to impersonate a trusted vendor or executive. The email address or domain might look real, but sender analysis can catch issues like failed authentication checks or past suspicious activity, helping you spot these threats before they do damage.
Blog Posts
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
Detecting malicious AnonymousFox email messages sent from compromised sites · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Attack Types (7):
Credential Phishing
Malware/Ransomware
Callback Phishing
Spam
BEC/Fraud
Extortion
Reconnaissance
Tactics & Techniques (27):
Impersonation: Brand
Lookalike domain
Social engineering
QR code
Image as content
Evasion
Impersonation: Domain
Impersonation: Email address
ICS Phishing
Free email provider
Out of band pivot
Impersonation: Employee
PDF
Spoofing
Scripting
Free subdomain host
Free file host
Macros
Open redirect
HTML smuggling
Exploit
Impersonation: VIP
Encryption
OneNote
IPFS
LNK
Punycode
Rule Name & Severity
Last Updated
Types, Tactics & Capabilities
Brand impersonation: FedEx
2d ago
May 8th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Header analysis
Sender analysis
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Header analysis
Sender analysis
Attachment: SVG files with evasion elements
2d ago
May 8th, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
QR code
Image as content
Evasion
File analysis
XML analysis
QR code analysis
Sender analysis
Malware/Ransomware
Credential Phishing
QR code
Image as content
Evasion
File analysis
XML analysis
QR code analysis
Sender analysis
Brand impersonation: Quickbooks
2d ago
May 8th, 2026
Sublime Security
Callback Phishing
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
Callback Phishing
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
Service abuse: Microsoft with suspicious indicators in subject
3d ago
May 7th, 2026
Sublime Security
Credential Phishing
Spam
Impersonation: Brand
Social engineering
Sender analysis
Content analysis
Credential Phishing
Spam
Impersonation: Brand
Social engineering
Sender analysis
Content analysis
Observed IOC: Malicious sender domains
3d ago
May 7th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
Observed IOC: Malicious sender email addresses
3d ago
May 7th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
Brand Impersonation: PayPal
3d ago
May 7th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Computer Vision
Content analysis
File analysis
Header analysis
Sender analysis
Credential Phishing
Impersonation: Brand
Lookalike domain
Social engineering
Computer Vision
Content analysis
File analysis
Header analysis
Sender analysis
Spam: Website errors solicitation
3d ago
May 7th, 2026
Sublime Security
Spam
Content analysis
Sender analysis
Natural Language Understanding
Spam
Content analysis
Sender analysis
Natural Language Understanding
Business Email Compromise (BEC) with request for mobile number
3d ago
May 7th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
BEC/Fraud
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Booking.com
4d ago
May 6th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Natural Language Understanding
Header analysis
Sender analysis
Credential Phishing
Impersonation: Brand
Social engineering
Natural Language Understanding
Header analysis
Sender analysis
Suspicious newly registered reply-to domain with engaging financial or urgent language
4d ago
May 6th, 2026
Sublime Security
BEC/Fraud
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
URL analysis
Whois
BEC/Fraud
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
URL analysis
Whois
Link: Cloud service with credential theft language
4d ago
May 6th, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
URL analysis
Credential Phishing
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
URL analysis
Callback phishing via calendar invite
4d ago
May 6th, 2026
Sublime Security
Callback Phishing
Social engineering
Evasion
ICS Phishing
File analysis
Header analysis
Natural Language Understanding
Sender analysis
Callback Phishing
Social engineering
Evasion
ICS Phishing
File analysis
Header analysis
Natural Language Understanding
Sender analysis
Service Abuse: Zoom with freemail reply-to and recipient address in greeting
4d ago
May 6th, 2026
Sublime Security
Spam
Free email provider
Social engineering
Sender analysis
Header analysis
Content analysis
Spam
Free email provider
Social engineering
Sender analysis
Header analysis
Content analysis
Service abuse: Zoom with newly registered reply-to domain
6d ago
May 4th, 2026
Sublime Security
Spam
Social engineering
Evasion
Sender analysis
Header analysis
Whois
Spam
Social engineering
Evasion
Sender analysis
Header analysis
Whois
PayPal invoice abuse
6d ago
May 4th, 2026
Sublime Security
BEC/Fraud
Callback Phishing
Evasion
Social engineering
Content analysis
Header analysis
Sender analysis
BEC/Fraud
Callback Phishing
Evasion
Social engineering
Content analysis
Header analysis
Sender analysis
Callback phishing: AOL senders with suspicious HTML template or PDF attachment
6d ago
May 4th, 2026
Sublime Security
Callback Phishing
Free email provider
Social engineering
Content analysis
Header analysis
File analysis
HTML analysis
Exif analysis
Sender analysis
Callback Phishing
Free email provider
Social engineering
Content analysis
Header analysis
File analysis
HTML analysis
Exif analysis
Sender analysis
Callback phishing via Zelle Service Abuse
6d ago
May 4th, 2026
Sublime Security
BEC/Fraud
Callback Phishing
Evasion
Social engineering
Content analysis
Header analysis
Sender analysis
BEC/Fraud
Callback Phishing
Evasion
Social engineering
Content analysis
Header analysis
Sender analysis
BEC/Fraud: Student loan callback phishing
6d ago
May 4th, 2026
Sublime Security
BEC/Fraud
Free email provider
Out of band pivot
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
BEC/Fraud
Free email provider
Out of band pivot
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
Canva infrastructure abuse
6d ago
May 4th, 2026
Sublime Security
BEC/Fraud
Callback Phishing
Social engineering
Impersonation: Brand
Impersonation: Employee
Free email provider
Natural Language Understanding
Sender analysis
Content analysis
BEC/Fraud
Callback Phishing
Social engineering
Impersonation: Brand
Impersonation: Employee
Free email provider
Natural Language Understanding
Sender analysis
Content analysis
Page 1 of 25

Rule Name & Severity	Last Updated	Author	Types, Tactics & Capabilities
Brand impersonation: FedEx	2d ago May 8th, 2026	Sublime Security	Credential Phishing Impersonation: Brand Lookalike domain Social engineering Header analysis Sender analysis
Attachment: SVG files with evasion elements	2d ago May 8th, 2026	Sublime Security	Malware/Ransomware Credential Phishing QR code Image as content Evasion File analysis XML analysis QR code analysis Sender analysis
Brand impersonation: Quickbooks	2d ago May 8th, 2026	Sublime Security	Callback Phishing Credential Phishing Impersonation: Brand Social engineering Computer Vision Content analysis Header analysis Sender analysis
Service abuse: Microsoft with suspicious indicators in subject	3d ago May 7th, 2026	Sublime Security	Credential Phishing Spam Impersonation: Brand Social engineering Sender analysis Content analysis
Observed IOC: Malicious sender domains	3d ago May 7th, 2026	Sublime Security	BEC/Fraud Credential Phishing Malware/Ransomware Social engineering Sender analysis Header analysis
Observed IOC: Malicious sender email addresses	3d ago May 7th, 2026	Sublime Security	BEC/Fraud Credential Phishing Malware/Ransomware Social engineering Sender analysis Header analysis
Brand Impersonation: PayPal	3d ago May 7th, 2026	Sublime Security	Credential Phishing Impersonation: Brand Lookalike domain Social engineering Computer Vision Content analysis File analysis Header analysis Sender analysis
Spam: Website errors solicitation	3d ago May 7th, 2026	Sublime Security	Spam Content analysis Sender analysis Natural Language Understanding
Business Email Compromise (BEC) with request for mobile number	3d ago May 7th, 2026	Sublime Security	BEC/Fraud Social engineering Content analysis Natural Language Understanding Sender analysis
Brand impersonation: Booking.com	4d ago May 6th, 2026	Sublime Security	Credential Phishing Impersonation: Brand Social engineering Natural Language Understanding Header analysis Sender analysis
Suspicious newly registered reply-to domain with engaging financial or urgent language	4d ago May 6th, 2026	Sublime Security	BEC/Fraud Social engineering Content analysis Header analysis Natural Language Understanding Sender analysis URL analysis Whois
Link: Cloud service with credential theft language	4d ago May 6th, 2026	Sublime Security	Credential Phishing Social engineering Content analysis Natural Language Understanding Sender analysis URL analysis
Callback phishing via calendar invite	4d ago May 6th, 2026	Sublime Security	Callback Phishing Social engineering Evasion ICS Phishing File analysis Header analysis Natural Language Understanding Sender analysis
Service Abuse: Zoom with freemail reply-to and recipient address in greeting	4d ago May 6th, 2026	Sublime Security	Spam Free email provider Social engineering Sender analysis Header analysis Content analysis
Service abuse: Zoom with newly registered reply-to domain	6d ago May 4th, 2026	Sublime Security	Spam Social engineering Evasion Sender analysis Header analysis Whois
PayPal invoice abuse	6d ago May 4th, 2026	Sublime Security	BEC/Fraud Callback Phishing Evasion Social engineering Content analysis Header analysis Sender analysis
Callback phishing: AOL senders with suspicious HTML template or PDF attachment	6d ago May 4th, 2026	Sublime Security	Callback Phishing Free email provider Social engineering Content analysis Header analysis File analysis HTML analysis Exif analysis Sender analysis
Callback phishing via Zelle Service Abuse	6d ago May 4th, 2026	Sublime Security	BEC/Fraud Callback Phishing Evasion Social engineering Content analysis Header analysis Sender analysis
BEC/Fraud: Student loan callback phishing	6d ago May 4th, 2026	Sublime Security	BEC/Fraud Free email provider Out of band pivot Social engineering Content analysis Natural Language Understanding Sender analysis
Canva infrastructure abuse	6d ago May 4th, 2026	Sublime Security	BEC/Fraud Callback Phishing Social engineering Impersonation: Brand Impersonation: Employee Free email provider Natural Language Understanding Sender analysis Content analysis