Observed IOC: Malicious sender domains

calendar Aug 7, 2026  ·
Share on: linkedin copy

Detects inbound messages sent from known malicious sender domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

Sublime rule (View on GitHub)

 1name: "Observed IOC: Malicious sender domains"
 2description: "Detects inbound messages sent from known malicious sender domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed."
 3type: "rule"
 4severity: "high"
 5source: |
 6  // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
 7  // Managed by automated IOC system
 8  type.inbound
 9  and hash.sha256(sender.email.domain.domain) in (
10    '049a4890de5dead7b5b968c191d56aba74e4d96c3712c6016142c6e00b0bb7b6', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
11    '093eb118a285207aba5a508be66c4a7f227537f9e3912b7edf627e534cf47515', // Observed malicious sender domain
12    '28b686d3c7b091ebdda1373f58a16635f4dacaaa748d0a4f2175273a09662770', // Malicious Sender - Multiple Lures spaning multiple days
13    '2cab1cbee39b6e639cec3d46fb270eaf6fdbd66b24049e0aed8cb0746fd91ead', // Observed malicious sender domain
14    '2d86a54a53f7a6d8db44135011f248f73bc6363208bb054781a5fd6cd5a68ef0', // Observed malicious sender domain
15    '344964b8f8ee23b4c5ebb446b85722abae2e15fa30a710219b348f21c4c03ac1', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
16    '6798365fdfb2f39074e58d4221541c778ba593a099ad3b334224a1f992a63313', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
17    '6f2681220ecf14f51e24f398daa4a0a5d8044fcccc67969bcfa5254e803b082c', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
18    '716ebb3424a6e8ef5ec500c3e6cf3a4f44c7901033d95352ee1db8d656e2878e', // Observed malicious sender domain
19    '90d3c2c031a19cd887556d924842fb4300dc3890429e9da2b5c267a862be7f9b', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
20    'bc0b660d1726f95579835f2694c4f58c656f431fbbc810c7fc4d19f2b2a177d7', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
21    'd758b32f46a81a66e5844fc072486b6860625aea5a79e3051cf9df00a47c3f5d', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
22    'd789e66005bd9398bcf48a0f28845f20b3678f4d0a2b44932e8c168fcfe22be7', // Observed malicious sender domain
23    'de9e07c5b87055b27e8419cfd89485c7b374deec228dc51d6aa710c68de27965', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
24    'ec22dbb0ccf84314288fdd0cf30bfce860451b90d8e4b29a1c2a1c03b2172d41', // Observed malicious sender domain
25    'ec74a3b1b533fa08aada394224a5fc46a60f02a84950d8085885dd0d61e9e9dd' // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
26  )  
27
28attack_types:
29  - "BEC/Fraud"
30  - "Credential Phishing"
31  - "Malware/Ransomware"
32tactics_and_techniques:
33  - "Impersonation: Domain"
34  - "Social engineering"
35detection_methods:
36  - "Sender analysis"
37  - "Header analysis"
38id: "c2d3e4f5-a6b7-4c9d-ae1f-a2b3c4d5e6f7"
to-top