Detection Method: Sender analysis

Sender analysis helps you assess whether an email is coming from a legitimate sender. By combining machine learning and rules-based logic, this method evaluates sender profiles, looking at things like authentication results, past behavior, and patterns from previous messages.
Sender analysis can help you detect:
  • Impersonation attempts using fake email addresses or domains
  • Suspicious senders with authentication issues (e.g., SPF, DKIM, DMARC failures)
  • Unusual behavior based on historical patterns, like frequent urgent requests
  • Senders linked to known phishing or malware campaigns
  • Changes in sender behavior that could indicate a compromised account
For example, an attacker might try to impersonate a trusted vendor or executive. The email address or domain might look real, but sender analysis can catch issues like failed authentication checks or past suspicious activity, helping you spot these threats before they do damage.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
BEC/Fraud: Fake investment outreach from suspicious TLD
38m ago
Oct 6th, 2026
Sublime Security
Fake voicemail notification (untrusted sender)
1h ago
Oct 6th, 2026
Sublime Security
Spoofing: Hidden Outlook headers in self-addressed forwards
4h ago
Oct 6th, 2026
Sublime Security
Service abuse: Google callback scam
4h ago
Oct 6th, 2026
Sublime Security
Brand impersonation: ConstructConnect
5h ago
Oct 6th, 2026
Sublime Security
Service Abuse: American Express callback scam
5h ago
Oct 6th, 2026
Sublime Security
Observed IOC: Malicious sender email addresses
6h ago
Oct 6th, 2026
Sublime Security
Spamhaus: Mail transiting an ASN-DROP listed network
6h ago
Oct 6th, 2026
Sublime Security
Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group
6h ago
Oct 6th, 2026
Sublime Security
Spamhaus: Mail transiting a DROP listed network
6h ago
Oct 6th, 2026
Sublime Security
Brand impersonation: Amazon
1d ago
Oct 5th, 2026
Sublime Security
Attachment: Fake email body embedded in inline image
1d ago
Oct 5th, 2026
Sublime Security
Credential phishing: Generic document sharing
2d ago
Oct 4th, 2026
Sublime Security
Spam: Fake photo share
4d ago
Oct 2nd, 2026
Sublime Security
Service abuse: Microsoft Power Apps callback scam
4d ago
Oct 2nd, 2026
Sublime Security
Brand impersonation: Google Authenticator
4d ago
Oct 2nd, 2026
Sublime Security
Business Email Compromise: Request for mobile number via reply thread hijacking
4d ago
Oct 2nd, 2026
Sublime Security
Brand impersonation: DHL
5d ago
Oct 1st, 2026
Sublime Security
Credential phishing: Email delivery failure impersonation
5d ago
Oct 1st, 2026
Sublime Security
Credential phishing: Engaging language and other indicators (untrusted sender)
5d ago
Oct 1st, 2026
Sublime Security