Attack Type: Spam

Spam refers to bulk, unsolicited messages, often promoting questionable offers, fake opportunities, or irrelevant content you never asked for. These messages typically ignore basic rules around consent and use shady tactics to sneak past filters, like misspelled words (“W1NNER,” “FREEBlE”) or fake brand names that look close to the real thing (“L0WES,” “C0STC0”).
You’ve probably seen examples: work-from-home schemes with unrealistic pay, miracle health products, SEO pitches warning about your website, or companies pushing “verified” contact lists. Some spam even pretends to be part of an ongoing thread by adding fake “RE:” or “FWD:” subject lines.
Even when the emails look polished or pass authentication checks, they’re often filled with misleading claims, fake urgency, or vague references to prior contact. While not always malicious, spam clutters inboxes, wastes time, and occasionally serves as a delivery method for more serious threats.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Headers: Reserved domain in Message-ID
3h ago
Oct 26th, 2026
Sublime Security
Link: Romance/Sexual Language With Suspicious Link
4h ago
Oct 26th, 2026
Sublime Security
Link: home.php affiliate tracking token
4d ago
Oct 23rd, 2026
Sublime Security
Link: Google Cloud Storage /index and /unsub link pair
4d ago
Oct 23rd, 2026
Sublime Security
Link: Google Cloud Storage object named after its bucket
4d ago
Oct 23rd, 2026
Sublime Security
Link: Google Cloud Storage with double base64 encoded fragment
4d ago
Oct 23rd, 2026
Sublime Security
Spam: Large financial amount mention from newly registered sender domain
5d ago
Oct 22nd, 2026
Sublime Security
Brand impersonation: MyChart
13d ago
Oct 14th, 2026
Sublime Security
Evasion: Zero-width character stuffing in subject or sender name
18d ago
Oct 9th, 2026
Sublime Security
Open redirect: Newslit.co
18d ago
Oct 9th, 2026
Sublime Security
Service abuse: Conceptboard VIP impersonation lure
18d ago
Oct 9th, 2026
Sublime Security
Link: Giveaway lure with amsweb.php redirect path
19d ago
Oct 8th, 2026
Sublime Security
Spam: Personalized subject and greetings via Salesforce Marketing Cloud
19d ago
Oct 8th, 2026
Sublime Security
Spam: Fake photo share
19d ago
Oct 8th, 2026
Sublime Security
Link: Case-striped affiliate tracking token
19d ago
Oct 8th, 2026
Sublime Security
Link: Echo-tail od= affiliate tracking token
19d ago
Oct 8th, 2026
Sublime Security
Attachment: Calendar invite from excessive self-reply sender
20d ago
Oct 7th, 2026
Sublime Security
Link: Google Cloud Storage with base64 go/sub-ID fragment
21d ago
Oct 6th, 2026
Sublime Security
Link: Google Cloud Storage with prefixed base64 dash-record fragment
21d ago
Oct 6th, 2026
Sublime Security
Link: Google Cloud Storage with suffixed unsubscribe bucket
21d ago
Oct 6th, 2026
Sublime Security