Observed IOC: Malicious sender domains

calendar Aug 28, 2026  ·
Share on: linkedin copy

Detects inbound messages sent from known malicious sender domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

Sublime rule (View on GitHub)

 1name: "Observed IOC: Malicious sender domains"
 2description: "Detects inbound messages sent from known malicious sender domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed."
 3type: "rule"
 4severity: "high"
 5source: |
 6  // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
 7  // Managed by automated IOC system
 8  type.inbound
 9  and hash.sha256(sender.email.domain.domain) in (
10    '049a4890de5dead7b5b968c191d56aba74e4d96c3712c6016142c6e00b0bb7b6', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
11    '093eb118a285207aba5a508be66c4a7f227537f9e3912b7edf627e534cf47515', // Observed malicious sender domain
12    '2cab1cbee39b6e639cec3d46fb270eaf6fdbd66b24049e0aed8cb0746fd91ead', // Observed malicious sender domain
13    '2d86a54a53f7a6d8db44135011f248f73bc6363208bb054781a5fd6cd5a68ef0', // Observed malicious sender domain
14    '344964b8f8ee23b4c5ebb446b85722abae2e15fa30a710219b348f21c4c03ac1', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
15    '57de556c3dca6746efdca2a9e9585a67373719879ac1213355d3d6daaa0ac286', // Observed malicious sender domain - actor-controlled login-code phishing from enumerated mailboxes
16    '6798365fdfb2f39074e58d4221541c778ba593a099ad3b334224a1f992a63313', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
17    '6f2681220ecf14f51e24f398daa4a0a5d8044fcccc67969bcfa5254e803b082c', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
18    '90d3c2c031a19cd887556d924842fb4300dc3890429e9da2b5c267a862be7f9b', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
19    '9e2c4bc1eb5cce77acbd64fc1624f957dd73c2b98e55e0803f7bd85cf6b0a93b', // Observed malicious sender domain
20    'a9a6c84a2bca28f6078381525770238c427000acc138ff47fb9139ffe54cf993', // Observed malicious sender domain
21    'bc0b660d1726f95579835f2694c4f58c656f431fbbc810c7fc4d19f2b2a177d7', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
22    'c1480544a7268086e197e9f1832e8a3a30d0a9a11b750a8d87e7188505e51682', // Observed malicious sender domain
23    'd758b32f46a81a66e5844fc072486b6860625aea5a79e3051cf9df00a47c3f5d', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
24    'de9e07c5b87055b27e8419cfd89485c7b374deec228dc51d6aa710c68de27965', // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
25    'ec74a3b1b533fa08aada394224a5fc46a60f02a84950d8085885dd0d61e9e9dd' // Sender domain used in VIP-impersonation invoice/payment BEC with fabricated reply threads
26  )  
27
28attack_types:
29  - "BEC/Fraud"
30  - "Credential Phishing"
31  - "Malware/Ransomware"
32tactics_and_techniques:
33  - "Impersonation: Domain"
34  - "Social engineering"
35detection_methods:
36  - "Sender analysis"
37  - "Header analysis"
38id: "c2d3e4f5-a6b7-4c9d-ae1f-a2b3c4d5e6f7"
to-top