Attack Type: Spam

Spam refers to bulk, unsolicited messages, often promoting questionable offers, fake opportunities, or irrelevant content you never asked for. These messages typically ignore basic rules around consent and use shady tactics to sneak past filters, like misspelled words (“W1NNER,” “FREEBlE”) or fake brand names that look close to the real thing (“L0WES,” “C0STC0”).
You’ve probably seen examples: work-from-home schemes with unrealistic pay, miracle health products, SEO pitches warning about your website, or companies pushing “verified” contact lists. Some spam even pretends to be part of an ongoing thread by adding fake “RE:” or “FWD:” subject lines.
Even when the emails look polished or pass authentication checks, they’re often filled with misleading claims, fake urgency, or vague references to prior contact. While not always malicious, spam clutters inboxes, wastes time, and occasionally serves as a delivery method for more serious threats.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Spam: Commonly observed formatting of unauthorized free giveaways
9d ago
Jan 14th, 2026
Sublime Security
/feeds/core/detection-rules/spam-commonly-observed-formatting-of-unauthorized-free-giveaways-8bc49fa3
Brand impersonation: SendGrid
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/brand-impersonation-sendgrid-d800124f
Reconnaissance: Email address harvesting attempt
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/reconnaissance-email-address-harvesting-attempt-bb31efbc
Spam: Campaign with excessive display-text and keywords found
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/spam-campaign-with-excessive-display-text-and-keywords-found-140e46a1
Suspicious Links to Cloudflare R2 and Edge Services
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/suspicious-links-to-cloudflare-r2-and-edge-services-5dd3e5c8
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/becfraud-urgent-language-and-suspicious-sendinginfrastructure-patterns-ba8a79e0
Brand impersonation: Hulu
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/brand-impersonation-hulu-6833de58
Fake thread with suspicious indicators
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/fake-thread-with-suspicious-indicators-c2e18a57
Potential prompt injection attack in body HTML
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/potential-prompt-injection-attack-in-body-html-5fb24736
Spam: Campaign with excessive space/char obfuscation and free file hosted link
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/spam-campaign-with-excessive-spacechar-obfuscation-and-free-file-hosted-link-122bc0ca
Service abuse: Random Google Firebase sender address with suspicious content
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/service-abuse-random-google-firebase-sender-address-with-suspicious-content-9f8899a9
Open redirect: Cartoon Network
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/open-redirect-cartoon-network-7435e057
Suspicious subject with long procedurally generated text blob
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/suspicious-subject-with-long-procedurally-generated-text-blob-e819593d
Spam: URL shortener with short body content and emojis
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/spam-url-shortener-with-short-body-content-and-emojis-b7797e4c
Spam: Single recipient duplicated in cc
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/spam-single-recipient-duplicated-in-cc-387cacc9
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com)
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/spam-default-microsoft-exchange-online-sender-domain-onmicrosoftcom-3f2a64ce
Spam: Website errors solicitation
1mo ago
Dec 11th, 2025
Sublime Security
/feeds/core/detection-rules/spam-website-errors-solicitation-122ea794
Spam: Fake dating profile notification
1mo ago
Dec 3rd, 2025
Sublime Security
/feeds/core/detection-rules/spam-fake-dating-profile-notification-0f33fea2
Spam: Firebase password reset from suspicious sender
1mo ago
Dec 2nd, 2025
Sublime Security
/feeds/core/detection-rules/spam-firebase-password-reset-from-suspicious-sender-a2f673a9
Spam: SMTP & Proxy Communications in Email Body
1mo ago
Dec 2nd, 2025
Sublime Security
/feeds/core/detection-rules/spam-smtp-and-proxy-communications-in-email-body-2bdc6a3b