Attack Type: Spam

Spam refers to bulk, unsolicited messages, often promoting questionable offers, fake opportunities, or irrelevant content you never asked for. These messages typically ignore basic rules around consent and use shady tactics to sneak past filters, like misspelled words (“W1NNER,” “FREEBlE”) or fake brand names that look close to the real thing (“L0WES,” “C0STC0”).
You’ve probably seen examples: work-from-home schemes with unrealistic pay, miracle health products, SEO pitches warning about your website, or companies pushing “verified” contact lists. Some spam even pretends to be part of an ongoing thread by adding fake “RE:” or “FWD:” subject lines.
Even when the emails look polished or pass authentication checks, they’re often filled with misleading claims, fake urgency, or vague references to prior contact. While not always malicious, spam clutters inboxes, wastes time, and occasionally serves as a delivery method for more serious threats.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Spam: Image as content with hidden HTML element
24m ago
Jan 23rd, 2026
Sublime Security
/feeds/core/detection-rules/spam-image-as-content-with-hidden-html-element-5de8861f
Spam: Commonly observed formatting of unauthorized free giveaways
9d ago
Jan 14th, 2026
Sublime Security
/feeds/core/detection-rules/spam-commonly-observed-formatting-of-unauthorized-free-giveaways-8bc49fa3
Brand impersonation: SendGrid
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/brand-impersonation-sendgrid-d800124f
Spam: Campaign with excessive space/char obfuscation and free file hosted link
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/spam-campaign-with-excessive-spacechar-obfuscation-and-free-file-hosted-link-122bc0ca
Suspicious Links to Cloudflare R2 and Edge Services
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/suspicious-links-to-cloudflare-r2-and-edge-services-5dd3e5c8
Reconnaissance: Email address harvesting attempt
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/reconnaissance-email-address-harvesting-attempt-bb31efbc
Brand impersonation: Hulu
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/brand-impersonation-hulu-6833de58
Fake thread with suspicious indicators
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/fake-thread-with-suspicious-indicators-c2e18a57
Potential prompt injection attack in body HTML
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/potential-prompt-injection-attack-in-body-html-5fb24736
Spam: Campaign with excessive display-text and keywords found
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/spam-campaign-with-excessive-display-text-and-keywords-found-140e46a1
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com)
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/spam-default-microsoft-exchange-online-sender-domain-onmicrosoftcom-3f2a64ce
Service abuse: Random Google Firebase sender address with suspicious content
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/service-abuse-random-google-firebase-sender-address-with-suspicious-content-9f8899a9
Open redirect: Cartoon Network
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/open-redirect-cartoon-network-7435e057
Suspicious subject with long procedurally generated text blob
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/suspicious-subject-with-long-procedurally-generated-text-blob-e819593d
Spam: URL shortener with short body content and emojis
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/spam-url-shortener-with-short-body-content-and-emojis-b7797e4c
Spam: Single recipient duplicated in cc
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/spam-single-recipient-duplicated-in-cc-387cacc9
BEC/Fraud: Urgent language and suspicious sending/infrastructure patterns
11d ago
Jan 12th, 2026
Sublime Security
/feeds/core/detection-rules/becfraud-urgent-language-and-suspicious-sendinginfrastructure-patterns-ba8a79e0
Spam: Website errors solicitation
1mo ago
Dec 11th, 2025
Sublime Security
/feeds/core/detection-rules/spam-website-errors-solicitation-122ea794
Spam: Fake dating profile notification
1mo ago
Dec 3rd, 2025
Sublime Security
/feeds/core/detection-rules/spam-fake-dating-profile-notification-0f33fea2
Spam: Firebase password reset from suspicious sender
1mo ago
Dec 2nd, 2025
Sublime Security
/feeds/core/detection-rules/spam-firebase-password-reset-from-suspicious-sender-a2f673a9