Detection Method: Sender analysis

Sender analysis helps you assess whether an email is coming from a legitimate sender. By combining machine learning and rules-based logic, this method evaluates sender profiles, looking at things like authentication results, past behavior, and patterns from previous messages.
Sender analysis can help you detect:
  • Impersonation attempts using fake email addresses or domains
  • Suspicious senders with authentication issues (e.g., SPF, DKIM, DMARC failures)
  • Unusual behavior based on historical patterns, like frequent urgent requests
  • Senders linked to known phishing or malware campaigns
  • Changes in sender behavior that could indicate a compromised account
For example, an attacker might try to impersonate a trusted vendor or executive. The email address or domain might look real, but sender analysis can catch issues like failed authentication checks or past suspicious activity, helping you spot these threats before they do damage.
Blog Posts
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Credential phishing Charles Schwab account holders with 2FA bypass · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Hiding a $50,000 BEC financial fraud in a fake email thread · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
B2B freight-forwarding scams on the rise to evade financial fraud crackdowns · Blog · Sublime Security
Detecting malicious AnonymousFox email messages sent from compromised sites · Blog · Sublime Security
Detecting malicious AnonymousFox email messages sent from compromised sites · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Talking phish over turkey · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Hidden credential phishing within EML attachments · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Credential Phishing via Docusign abuse · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Living Off the Land: Callback Phishing via Docusign comment · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Adversarial ML: Extortion via LLM Manipulation Tactics · Blog · Sublime Security
Attack Types (7):
BEC/Fraud
Credential Phishing
Malware/Ransomware
Spam
Callback Phishing
Extortion
Reconnaissance
Tactics & Techniques (27):
Impersonation: Email address
Social engineering
Impersonation: Domain
Evasion
Free file host
Spoofing
Impersonation: Employee
Free email provider
Free subdomain host
Impersonation: Brand
Encryption
PDF
Image as content
Out of band pivot
Lookalike domain
Open redirect
Impersonation: VIP
HTML smuggling
Macros
QR code
Scripting
ICS Phishing
Exploit
OneNote
IPFS
LNK
Punycode
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Observed IOC: Malicious sender email addresses
3d ago
Jun 19th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
Observed IOC: Malicious sender domains
3d ago
Jun 19th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Malware/Ransomware
Social engineering
Sender analysis
Header analysis
Service abuse: DocSend share from an unsolicited reply-to address
4d ago
Jun 18th, 2026
Sublime Security
Credential Phishing
Evasion
Free file host
Social engineering
Content analysis
Header analysis
Sender analysis
Body: Fake secure email portal with HTML obfuscation
4d ago
Jun 18th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Spoofing
Content analysis
HTML analysis
URL analysis
Sender analysis
Threat intelligence
Employee impersonation: Payroll fraud
4d ago
Jun 18th, 2026
Sublime Security
BEC/Fraud
Impersonation: Employee
Free email provider
Social engineering
Content analysis
Sender analysis
Brand impersonation: Cloud services with credential theft intent
4d ago
Jun 18th, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Natural Language Understanding
Sender analysis
URL analysis
Service abuse: Google Firebase sender address with suspicious content
4d ago
Jun 18th, 2026
Sublime Security
Spam
Credential Phishing
Free subdomain host
Social engineering
Content analysis
Header analysis
HTML analysis
Natural Language Understanding
Sender analysis
URL analysis
Whois
Credential phishing: Fake storage alerts (unsolicited)
4d ago
Jun 18th, 2026
Sublime Security
Credential Phishing
Social engineering
Content analysis
Sender analysis
Brand impersonation: Bids & Tenders
5d ago
Jun 17th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Spoofing
Social engineering
Sender analysis
URL analysis
Content analysis
Service abuse: Outlook Groups with Google Sites link and evasion tag
5d ago
Jun 17th, 2026
Sublime Security
Credential Phishing
Evasion
Free subdomain host
Social engineering
Content analysis
Header analysis
URL analysis
Sender analysis
Brand impersonation: Microsoft
5d ago
Jun 17th, 2026
@amitchell516
Credential Phishing
Impersonation: Brand
Social engineering
Content analysis
Sender analysis
Evasion: Hidden content divs from freemail sender
5d ago
Jun 17th, 2026
Sublime Security
Credential Phishing
Evasion
Free email provider
HTML analysis
Content analysis
Sender analysis
Brand impersonation: Quickbooks
5d ago
Jun 17th, 2026
Sublime Security
Callback Phishing
Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
Content analysis
Header analysis
Sender analysis
Attachment: Encrypted PDF with credential theft body
5d ago
Jun 17th, 2026
Sublime Security
Credential Phishing
Encryption
Evasion
PDF
Social engineering
Content analysis
Exif analysis
File analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Fake Fax
5d ago
Jun 17th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Image as content
Free file host
Free subdomain host
Social engineering
Computer Vision
Content analysis
Optical Character Recognition
Sender analysis
URL analysis
Fake thread with suspicious indicators
5d ago
Jun 17th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Spam
Evasion
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Reconnaissance: Short generic greeting message
5d ago
Jun 17th, 2026
Sublime Security
BEC/Fraud
Callback Phishing
Social engineering
Free email provider
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Brand impersonation: Survey request with credential theft indicators
5d ago
Jun 17th, 2026
Sublime Security
Credential Phishing
Social engineering
Impersonation: Brand
Spoofing
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
Self-impersonation: Sender matches recipient with bolded name and suspicious link
6d ago
Jun 16th, 2026
Sublime Security
Credential Phishing
Evasion
Social engineering
Header analysis
HTML analysis
Sender analysis
Fake Zoom meeting invite with suspicious link
6d ago
Jun 16th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Evasion
Social engineering
Content analysis
Header analysis
Natural Language Understanding
Sender analysis
URL analysis
Page 1 of 25