Observed IOC: Malicious sender email addresses

  1name: "Observed IOC: Malicious sender email addresses"
  2description: "Detects inbound messages from known malicious sender email addresses. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed."
  3type: "rule"
  4severity: "high"
  5source: |
  6  // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
  7  // Managed by automated IOC system
  8  type.inbound
  9  and hash.sha256(sender.email.email) in (
 10    '01168278f16f3b1a6bd19f3d18022dc0a1310e508c38a92f074e1fdb47599b80', // Compromised account sending real estate closing wire fraud using authentic mortgage document terminology and a signed loan application reference in the subject
 11    '0284f2b1d0144e40ef468ec720ded81b7d89d22515e79450df7e6c135ee581bb', // Compromised account at a sawmill business sending real estate closing document and payoff statement wire fraud
 12    '02d45de1a331cece5978ec8ac6dc7176394e5697726be384d0051ea2d7ade01d', // Mailbox on an established agency domain operated for fraud with no legitimate traffic observed, cycling fabricated personas across realtor referral fee, remote work and charity solicitation lures, each with its own freemail reply-to including one that substitutes a double character for a single letter in the persona's own name
 13    '030e1018afa151eada89a993f1d9f1ef1ea436e17f929b634af3db3cddef702a', // Attacker-controlled domain - Aged domain repurposed with its own sending gateway and no legitimate traffic observed, delivering fabricated forwarded invoice threads from an invented risk advisory firm to accounts payable aliases, with the display name set to a recipient side finance contact and a reply-to carrying that contact's first name on attacker registered infrastructure
 14    '06da6631f2f809800820402c897f657a00ce50180ac18563e5603e7232643fe3', // Attacker-created subdomain on a free subdomain host, sending federal solicitation bid pricing lures that invite the recipient to join a fabricated government proposal and request project requirements by reply
 15    '071e64a533dc237e9fa45080aab3244c07db0e1ad315f1e61691ae5ccd57785c', // Compromised hospital mailbox sending electronic signature and shared non-disclosure agreement credential phishing through a commercial mail service, splicing each recipient organisation's own name into the subject line behind a lock or new document emoji
 16    '075611e71dd512da1e6ef355ea904e3fe5923cd7fc97970947110d81cda63e89', // Attacker created mailbox on an aged Czech domain following a noreply prefixed naming pattern, sending advance fee loan offers with a mismatched reply-to
 17    '08b013bea787508dbdfcdb6402cdf20948df1123cd0e4f1f8a771e7805d8dd7c', // Attacker-controlled procurement subdomain, one of several sharing an identical local part across unrelated Australian root domains, sending quotation and purchase order inquiry fraud that carries the recipient's own name in the subject
 18    '0ea0cbdc9bfe9743e6e7d554aee297ce1bb2cbffa9ce5f8d7be458dee7b2ecf8', // Compromised account running vendor impersonation with the recipient's own domain and a timestamp in the subject line, diverting replies to a third party and pairing a typosquat of the impersonated contractor with the genuine domain
 19    '0eb988e9f6aca75714c0aaf827336471dda7294b94b0e6d45617fbddae4c5f60', // Compromised education account - callback phishing fake invoice and order confirmation lures blind copied to Microsoft 365 group addresses
 20    '0f862ede934f0ce7b5c979aa9fd6fcfaa6dba5379d809b58a77066fcd52db733', // Advance fee fraud investment and partnership solicitations sent with no links or attachments from a recently registered domain
 21    '0f8c87849a6789b59a96cddceffbff6ff308c44f6f1634e9175072d49430a352', // Second compromised mailbox on the same domain sending the same vendor impersonation template with a date in place of the timestamp
 22    '117bd7906cccfd8296fa626aa59031c27b84af02c7374f8b3e1556b7023d99f9', // Attacker-registered domain - mortgage relief lead fraud fabricating a nonexistent federal homeowner relief program with invented file status and eligibility fields behind a compliant commercial footer
 23    '11e5ec5c15be2c0841f89b20359ddc7f13bea3880f1206de75aba502500a11a8', // Compromised mailbox sending request for proposal lures whose only body link is a consumer link aggregator page shared with unrelated compromised senders
 24    '157cc9823da3c2bdf89f852f21188cd22155df1b9a67f89e64c83b49be2959d6', // Compromised government education mailbox sending Spanish language data validation reply bait with no payload link, targeting a government security contact
 25    '16e22932934d08c8ff52b7fb28881376951923cf371a72b03427828a45e61053', // Second attacker-registered domain of the same operator impersonating a securities firm, sending the same donor relationship partnership lure to the same target under a different invented persona
 26    '18bf27e764014ffb840759d12e2bb5bf4615112e2a1dc77671b584ecfa607ca8', // Compromised mailbox on a long established Gulf trading company domain sending procurement fraud under an invented buyer persona that does not match the mailbox local part, cycling product catalogue, bulk pricing and quotation request lures
 27    '1b612abbec21c92787840b3e57706aa9246565dc6266b138447c035039304622', // Compromised Brazilian non-profit mailbox sending contract execution, remittance advice and weekly payment run lures with the reply-to diverted to an unrelated third-party collection address, authenticated from the domain's own infrastructure
 28    '1b7bc5e625687a8b721e79084684f736525b10ad2e2d82e4ef8bf9ba249deb4c', // Compromised mailbox sending fund prospectus update lures naming a security identifier in the subject, matching an identical template sent from an unrelated compromised domain
 29    '1ce991744a50dfa9d47b2111822cad863ca7dbbd8e96f40dd4b8ae8089ca1cd2', // Compromised mailbox sending request for proposal lures whose only body link is a consumer link aggregator page shared with unrelated compromised senders, plus an unrelated voice message payment lure from the same account
 30    '245e37a1bf65bb14a41e88c064f2bb0da3416c3fce1571df00095d885b848c8b', // Compromised education account - fake photo share spam with image attachments and a URL shortener redirect
 31    '25fdf4b62187deaf2c74bf3b17bf7658caa15a99778c15d3622860f0c3ddce31', // Compromised consumer ISP mailbox running executive impersonation business email compromise, where the entire subject line is the impersonated executive's name and the display name is a fabricated urgency phrase, rotating a different university president or company chief executive per recipient organisation
 32    '2724fa8d177cba405381e7077eb72522796ac3f4e4b0fb9f841cf46bb441cb90', // Compromised construction firm mailbox with the display name forged to an unrelated Spanish transport company, sending Spanish language invoice remittance disbursement lures whose attached payment advice is renamed for each recipient organisation, with a diverted reply-to on an unrelated domain
 33    '2af39b39e4fd82c0dc02ce18bce61b2ec8dfeb2833ffa8a2659a31a2456ecce7', // Recently registered domain behind a privacy service impersonating a capital markets firm, sending fabricated family office investment interest outreach that splices the recipient's own personal name into the message as though it were the target company, with an unfilled greeting placeholder
 34    '2bb521eefc152fc39a193794df4b59ca5a097a8d60fc7d020628000e51979484', // Aged domain repurposed with no legitimate traffic observed, sending strategic supplier and request for quotation solicitations that impersonate a Fortune 250 motion control manufacturer under a fabricated vice president of global supply chain persona, delivered through a commercial mail service
 35    '2d64fcd4bb2b0530de70c2de74dcf706a4e4ae1165f95bc3c81f539acc470c60', // Attacker-controlled domain with a purpose built relay subdomain, soliciting quotations under a fabricated investment company identity and address while diverting replies to a free encrypted mail provider
 36    '2eb61d0d455b3da48bfffbed3d0f2aecb8025e32d14d1a0d55e5bde9883bc120', // Second attacker-registered domain of the same operator sharing the registrar, privacy service and the convention of repeating the mailbox local part as the sending subdomain, impersonating a Japanese credit card issuer with a right-to-left override display name, zero width characters inside the subject and an attachment with a randomised file extension
 37    '30cf2d48ff08e6eca41000f87e9899172f5b367232c41b0245b428e8fd357192', // Compromised government education mailbox sending authentication code themed credential phishing sharing a payload host and path with sibling government senders
 38    '31a90dd3ba48b5699a49bc05590b896ac8465d5b0c27807d1896e3fae6ecd4bd', // Newly registered domain impersonating a state health service, sending emergency safety bundle award notifications that substitute a capital I for a lowercase L throughout the subject and display name
 39    '3474641b4c345f6ba66ca08d4f9ce8a8225de1d3f8ddfb07dd0cc1c2aaffa159', // Recently registered attacker-controlled domain serving as the reply-to collection point for a request for quotation fraud campaign fronted by compromised third party mailboxes, and sending directly under the same invented project manager persona
 40    '34bf9da1158ad5c58460fdc0c3e4b815df415443fd5a4a9a6b7f75cc2e5dd3b7', // Compromised government education mailbox sending authentication code themed credential phishing with decoy body text concealing links to a randomly named GitHub Pages host
 41    '39199beecd8f3061935834e5b5aa220b63811cd706b9c86e7692df5742c29427', // Attacker-controlled mailbox sending fabricated two-reply invoice approval threads that impersonate named executives of the targeted organizations, with zero-width joiners stuffed through the subject and body and reply-to addresses on a lookalike coaching domain
 42    '3add803e0b5b9422e2ced3da98e73d71129ef521f72e8b9b50b2c1830876ad05', // Attacker-registered domain on a privacy registrar - product export supply request business email compromise to undisclosed recipients
 43    '3b19647f6e612f7ee05a94450e414436cf2344585c0a284b083b7c8347e4cddc', // Compromised mailbox sending request for proposal lures whose only body link is a consumer link aggregator page shared with unrelated compromised senders
 44    '3bec8e1bc42caa470c611cc5d481a2e0da08c240813a7427b9390f765a4304cc', // Compromised education account - callback phishing fake invoice and order confirmation lures blind copied to Microsoft 365 group addresses
 45    '3c02448192d6ff63670d79ee272053cecb005d46c4956112ef15a428b0c785c3', // Compromised accountancy practice mailbox sending shared electronic file notification credential phishing that substitutes a lowercase letter for a capital in the word notification, followed by a message recall variant of the same lure
 46    '41510787bec9cf8433d8a725e9cf8026a27c420e9e2ed20d4fb0218b95813e6d', // Compromised account - advance fee fraud workers compensation fund and inheritance lures with a freemail reply contact pivot
 47    '41890eb302a6e4a015c97a8ddcaea37b08ff6fff26ff47f9f5021027717839ed', // Compromised mailbox sending purchase order and quotation request fraud to unrelated recipient organisations including a county government
 48    '41b486a0b4900285c491f1373fe7130cd64e86b3052ed10e92031029dab53440', // Compromised account - payroll bank account change request impersonating a named employee of the recipient organisation, with no links or attachments so the reply is the ask
 49    '43442111c2efd1fc3af1e135377b0a649200020bc3e574566654f2dccdd015a5', // Attacker-created mailbox on a random-string domain with a dedicated cloud sending subdomain and no other observed use, sending request for quote fraud under an invented Western personal name
 50    '463094389b027493ff9362bf506f75a6751e298b8d4fecc35da11175d166546f', // Attacker-registered domain behind a privacy registrar using an app subdomain and a noreply local part to mimic a sending platform, delivering compensation and policy document lures with an attachment named after the recipient organisation
 51    '47ea0b251c090988db6e2a2ba99428bd1b4c190ce1abc0339c4d6e7ea7b4675c', // Attacker-registered domain sending fabricated vendor agreement completion notifications that name a different invented counterparty firm in each subject
 52    '48449d544d398899c5f25ff2e2a2ea6ac2889dcdc346ec990cd7b13cbafb630d', // Compromised consumer ISP mailbox sending German tax refund release phishing linking a compromised third party host
 53    '4a5e654c59536255e73f04d98b9e2db86341a11c54c7b97f9f8eee34582fbfab', // Attacker-created tenant on a self-service business platform, rotating federal court filing, bank and payment provider secure packet credential phishing templates
 54    '51d51b1fe85cfab594409daf99bd995fdadad2cf9ade1b759f552c7ec7cee4cc', // Attacker-registered domain behind a privacy service, sending a fabricated invoice thread and reply follow-up that impersonates a software vendor's billing correspondence, with template placeholder links left unrendered in the signature
 55    '5247b0c58b19441be5e840a09b81a4566771647e45977ccc8be0bead5b139c26', // Compromised mailbox on a long-established domain relayed through a shared hosting provider, sending request for quotation and estimate lures that impersonate a named contracting firm under an invented project manager persona, with the reply-to diverted to a recently registered lookalike domain and the date and time embedded in the subject
 56    '525fa64aa95c87eb09bbf28a2f7dd86ac68ae9bfc26a87fc77a9d848989680c4', // German retail bank credential phish impersonating Volksbank from an aged repurposed domain, using the same distinctive local part as an unrelated sending domain in the same campaign
 57    '53ed891f2c0fb15fcce73a4e6731f1433874dea7d3ba000af1b7e840ed7e329a', // Compromised consumer ISP account - awaiting feedback reply-chain BEC pretexting with a mismatched reply-to
 58    '54a602967647e342e3389df15a9d2ce52453aa38800aad1449f1942b88c37736', // Attacker-controlled mailbox sending Adobe Acrobat shared spreadsheet lures as calendar invitations to a mass recipient list, pairing genuine Microsoft Teams and Adobe links with a single payload host for the credential collector
 59    '5502acdf89fe972ba391e8aa9355919a1c3f920947169bbd23da5c6383e18433', // Attacker-registered lookalike domain - fake Google review removal scam campaigns
 60    '5799672d253ef5a1962e25559be03cd3d552f36147b87869e9a8d01c3db933a9', // Compromised hospitality domain mailbox sending construction project pricing request procurement fraud alongside a sibling mailbox running a meeting recording lure
 61    '57a8b399739a513c38fa4c2f88162f5890f9149b68c34f23e34c60b0fbeab39a', // Compromised education account - fake photo share spam with rotating display names and low reputation redirect link domains
 62    '5b02e0f4f2da47ff4495d6e19b204f4b5767cdf3466d21724018a08d5c9bb40f', // Recently registered domain on a hosted productivity suite with no published DMARC record, sending payment gateway confirmation and completed document notifications
 63    '5c0451dc24d7d3bc15e4e1997503b9a1c9c7b3cdcba37256b5fa3db0ae06c0da', // Attacker-controlled sending subdomain with no legitimate traffic observed, delivering bank themed credential phishing hosted on an open object storage bucket with genuine bank links included for cover and a generic single word subject
 64    '5dd6751ee719a5b57e2e739450bbe782a9db7c1efb8768f7bc5e1b1bee59f578', // Compromised account - Costco and Paramount billing deactivation phishing with payloads on free dynamic DNS hosts
 65    '5e398e23697657a7b1906a359aedd4aa9e4bf515634cce89f25749d71b2e520a', // Compromised account - advance fee reply bait using two character subjects and two word bodies with no links or attachments, sent to municipal recipients
 66    '606fc8cb0c6a64e8fa91be081153ab0059573e262a2aaebd0b3ee4ba1ad41dd5', // Indeed typosquat registered through the same registrar and privacy service as its inverted-name sibling, hosting the credential phishing landing page on the typosquat domain itself
 67    '609f2721a435e708c73c708c2a93d1ac7caa3bf515702318242c630442fb3507', // Attacker-registered lookalike domain - request for quotation fraud impersonating a UK IT distributor, soliciting laptop and computer hardware quotes with no payload link so the reply is the ask
 68    '60fa0dcced4f2003ca5197b9e3f342d7eebaaeee3a75f3eb6ef60428e73b52c6', // Attacker registered domain on a privacy registrar running a sustained advance fee fraud drip sequence through a commercial marketing platform, telling the recipient that deposited funds are frozen pending account verification
 69    '6395ce7c2c10362e5cd7826bfc461ef8f57f544f37c2d048cce8153eb79514fc', // Compromised university mailbox sending account update required credential phishing to a PHP harvester on a compromised host
 70    '66d853b843cffe57f7b14dcbc75382fbc0660ca5ff7b620954c952a11534e78e', // Attacker-controlled domain sending construction procurement and supplier invitation fraud impersonating Gilbane and Mortenson, with reply-to and CC diverted to freshly registered lookalike domains while body links point to the genuine brand sites
 71    '689c275450db4c6315ae38d86f9625a6db291f9b9a5008390948abb718ad2b4a', // Compromised mailbox on a trailer repair business domain sending electronic signature document lures under a spoofed Docusign display name, one of two abused mailboxes observed on the domain
 72    '6ab85393c0ee655aff273bd2d4fd3d009f9950ff3775acb9e034a32bb515c371', // Compromised cloud sending account on a long-established domain, sending accounts payable and receivable account review lures with engaging financial language
 73    '6d38d759aa6b2da6f04b5af557977574bb587b8f8b2b3a0d00237ff8e1f0c507', // Attacker-registered domain impersonating a corporate finance firm, sending fabricated donor support partnership outreach and following up with a reply prefixed variant of the same lure
 74    '6d99a8a44c607df42abe2695f7bb4271cb2da43b7426b331a21cdfb8d99c603c', // Compromised dealership mailbox - advance fee reply bait with an empty subject and a diverted freemail reply-to, sent to undisclosed recipients across multiple organisations
 75    '7b45a479773f66750cb15ecf449a8ba61d47d4841fdceeff8715cb1bf0e4e6fb', // Compromised business account sending German road enforcement process notification phishing with a per message case reference
 76    '7b888885460beac851375d5071077532cd6d6ab9ad6ab21b56b72eedc8e60778', // Attacker-registered lookalike of an established marine engineering firm, sending reply-bait requests that cite an email configuration fault and invite the recipient to respond so the missing attachment can be supplied, signed with the impersonated company's real address
 77    '7d270495ddda939562b61f1932e39bd4da34bad843a66a08306c9a92e0b41593', // Recently registered domain impersonating the Swiss Federal Commercial Registry Office, claiming a technical fault lost register data and threatening administrative measures and deletion of the register entry unless the recipient resubmits their details
 78    '7e7947ca13ee8f1270db7700920f6735b010eac37d1d0f7490f8b6d7ba39d099', // Indeed typosquat substituting a lowercase L for the capital I, hosting the credential phishing landing page on the typosquat domain itself and authenticating through a bulk email service
 79    '7f77b7d523927054be14b400b3717a30dd4b1b166c98fbc8a6025eaef79bcce4', // Attacker-controlled mailbox sending single recipient investor and acquisition interest solicitations that name the target organisation in the subject, part of a family that rotates sending domains while reusing the same local parts
 80    '81ee20bfabfd731a5d1cfed926e394b2d53af04c9913eff8edf32e977a2e13b4', // Compromised mailbox on a long established Japanese manufacturing domain sending employment reference request credential phishing hosted on a shared Power BI report, with zero width characters inserted into the payload hostname to defeat domain parsing
 81    '81f05f351ce3289a1aca73fd7baf1571ff491fcd9abe2e786f0125a2792c2adb', // Compromised mailbox on an aged Spanish business domain sending employment reference confirmation lures that share a single Power BI report identifier with the wider campaign
 82    '82be96048f52fad2c987e871538146f23bab15bc711032799c9075bf7e7e5c3a', // Compromised mailbox on a long-established domain relayed through a shared hosting provider, sending request for quotation and estimate lures that impersonate a named contracting firm under an invented project manager persona, with the reply-to diverted to a recently registered lookalike domain and the date and time embedded in the subject
 83    '84d2081f19806c0667e6f78e614c35e093af6d37f368f9ebc5256648a2996947', // Attacker-controlled domain in a family that rotates sending domains while reusing the same local parts, fabricating a prior thread through self referential message headers for a charitable giving advance fee lure
 84    '858214f8881d63a66b52ab87585f04465a31875e77755fe489b8e2291fe1c593', // Compromised school account - digital invoice lure with PDF attachment
 85    '882121ea0602f077fe97118cf483ab7e10574f92d3a68782a9e3928beb9cf3c4', // Compromised mailbox on a Spanish business domain sending an authenticated sequence of lottery winnings, unclaimed funds and personal assistant job scam lures
 86    '8cf93b3bcba9c454b1392f94cc67eafc5ce8a613fedb1df42a5277e79506c65f', // Attacker-controlled sending account delivering subscription expiry lures that insert invisible Unicode separators inside subject words to defeat string matching, sharing sending infrastructure with a sibling domain running the identical template
 87    '93652edb564c0576073f9270a5bdb7ea2110c1c4687c257df3b665f605b86d58', // Attacker-controlled mailbox impersonating the Swiss federal commercial register authority with a confirmation request, linking the genuine federal justice site alongside the collection domain
 88    '9a0376d3b13a18b2d760c53d48db862c406ccd8e9b24d9805d04bd80edc5642a', // Compromised mailbox on a long-established domain relayed through a shared hosting provider, sending request for quotation and estimate lures that impersonate a named contracting firm under an invented project manager persona, with the reply-to diverted to a recently registered lookalike domain and the date and time embedded in the subject
 89    'a07b34be762007b4fc58194139663c80e0014868ce3a3fd9b87846cb871dcddf', // Compromised mailbox sending callback phishing attachments whose file name is the full lure sentence, instructing the recipient to securely access an invoice receipt and retain a physical copy, with a display name unrelated to the sending local part
 90    'a30b9e5afabd2d3e32d4a4718cdbec3c44589f73fc271cf1c4daa1defb427a53', // Compromised consumer mailbox sending business email compromise reply bait that uses the name of the recipient organisation's own chief executive as the entire subject, with task oriented display names and no links or attachments
 91    'a4dc0e5924b01774853dd505d613f9bcddc0fd9a3112ae1f3fd70096b3510756', // Attacker registered domain on a privacy registrar sending purchase order and order inquiry fraud, rotating the display name per message and diverting replies to lookalike French distribution group domains
 92    'a5e4a34c61008604fedd0fbb7ec5398e9d375af3674eab5cacedc31e343ce79e', // Compromised mailbox sending fund prospectus update lures naming a security identifier in the subject, matching an identical template sent from an unrelated compromised domain
 93    'a796d63569cd8e01445bccf3ba4a7d76deb0f093ca75fd19716fd0ce1d190778', // Compromised mailbox sending partnership opportunity lures naming each recipient organisation, with reply-to diverted to a newly registered third-party collection domain shared across unrelated sending domains
 94    'a82572073c104d9e7e16599fe24e72479a1a7b3b96e6ba81b4df325881ded01b', // Attacker-registered domain - business email compromise first contact soliciting a fake client project with an out-of-band reply-to pivot to a separate attacker domain, targeting named executives
 95    'a9e190a92c69c786943f37d0a8dedf16f21237c269677f386b55a93c5f11599e', // Compromised account - forwarded consulting invoice lure requesting an electronic funds transfer to a third party entity
 96    'aa3a910fcfd2d4f7c2899b3263e86c60718e86b7a97073bb7ff59488ab75acc7', // Compromised mailbox on a long-established domain relayed through a shared hosting provider, sending request for quotation and estimate lures that impersonate a named contracting firm under an invented project manager persona, with the reply-to diverted to a recently registered lookalike domain and the date and time embedded in the subject
 97    'acf23fe903f596d0414f21cc423a5488eced253f21d59bd3d8799b6e05a21e54', // Compromised mailbox on a long-established domain relayed through a shared hosting provider, sending request for quotation and estimate lures that impersonate a named contracting firm under an invented project manager persona, with the reply-to diverted to a recently registered lookalike domain and the date and time embedded in the subject
 98    'ad883b033c35cc73e161a2e87831e0fe2147548b05b0b8c7d71362378273978b', // Compromised mailbox on an aged Spanish business domain sending Japanese language undelivered mail notifications that impersonate the recipient's own employee recognition platform and redirect through a consumer link shortener to a credential collector on a compromised content management site
 99    'ae916aa80773bd08077713bad93574a9b2f448975f38fac25508b3d60938e0cc', // Compromised Brazilian company mailbox sending disbursement disclosure lures with a randomised five-character subject suffix per message, delivered through Amazon SES
100    'af3fd54a8697e221b50857029081891fb58112c121f227cd91e8c62165ec7f2b', // Compromised mailbox on an aged contracting business domain sending authenticated event invitation lures that conceal an invisible redirect to a newly registered credential collector, blasted to the account's entire address book
101    'b20a8a14d56860961e5d85448e9001c1a9878844420d03887bc5a31b56fb3a6a', // Attacker-controlled sending account delivering subscription expiry lures that insert invisible Unicode separators inside subject words to defeat string matching, sharing sending infrastructure with a sibling domain running the identical template
102    'b31defc6924cd70ec55b87819a9f52b70e062a196fd4b978ebb19293d1159034', // Compromised account - Reply bait using a bare date and time stamp as the subject under a fabricated personal display name, carrying no links or attachments
103    'b33434cd2a9d4c1813b1fe5446cee17a44bbd1ef859ffca9648577283a19e3bc', // Compromised mailbox on a Greek regional government domain sending authenticated advance fee solicitations to undisclosed recipients across multiple unrelated organisations
104    'bb2429bf32cc782a345cbb314058cf33b80ce64dba667a9d9e71c237efb077ac', // Compromised government health service account sending German language credit and financing offer solicitations under an invented personal display name, carrying no links or attachments
105    'bda732e56dc1d6275eb123e7e810252493febcd495bd19430c902311b2e4cd29', // Attacker-controlled procurement subdomain, one of several sharing an identical local part across unrelated Australian root domains, sending product information request follow-up fraud that carries the recipient's own name in the subject
106    'bec945901b260865e49f32ed91dc986c9d96e60f36c5a089a4972adc7c7cf7f5', // Teams meeting recording credential phishing delivering an unlinked payload URL as plain text with instructions to copy it into a browser to evade link inspection
107    'bf5d4be8d2cee2476e9a226bd955f41819e4b01976f9bbd91b58bc82f057d4f6', // Observed malicious sender
108    'c3b0c918516e727053a88e41cc6f130cc0f1366af94317cc02584e3b572245a4', // Attacker-controlled domain using a purpose-built random subdomain and a postmaster local part with the display name forged to Microsoft Outlook, sending calendar sharing invitation notifications across unrelated organisations, including a variant carrying a Chinese currency exchange solicitation that points to a messaging app handle instead of a link
109    'c5616004a7192476f4e23a7ce74560327b60ca66aca6cda90d1d43a2718f9174', // Compromised mailbox on a long-established domain relayed through a shared hosting provider, sending request for quotation and estimate lures that impersonate a named contracting firm under an invented project manager persona, with the reply-to diverted to a recently registered lookalike domain and the date and time embedded in the subject
110    'c5920d9be6bc143f9396604898cc762e840b73e039f4b64947c911dd37f3065a', // Purpose-registered domain impersonating each recipient organisation in the display name, delivering calendar invite lures and an open redirect through a shopping comparison service to attacker-controlled cloud hosting, targeting managed service providers
111    'c5de7b606a223f658e18d69cfdc6fa0cd1777eefa9728bc8a7b396d6c7c7eb64', // Compromised account at a carpentry business sending domain renewal payment phishing with service disruption urgency
112    'c907b040ba2a18137ff2135da46dd8d8c081f5a7b7991fce9829c3255d6f776b', // Recently registered domain on a privacy registrar with no legitimate traffic observed, sending urgent package delivery and incomplete purchase notifications
113    'caab683320f2172162218406c6eba10ba5c8ac1aff106f5b7c23cd021e476cd0', // Compromised cloud sending account on a long-established domain, delivering corporate resolution and power of attorney dual signature requests alongside quarantine release lures, using a repurposed newsletter body as the visible content with the lure carried in a secure message themed PDF attachment whose filename mirrors the subject token
114    'cd0baaeeb6bd8c803d6913bb2264eed11a16c9e539b96bade33dcdd424778b73', // Recently registered domain behind a privacy service sending order confirmation pretexts that ask the recipient to confirm a shipping address for a purchase they did not place, under rotating invented personal display names
115    'cea91f8730cf23c353f33e3650120eafe84992aca4c5aa49c3c7a4aa3ca4996e', // Attacker-controlled domain with its own dedicated sending and click-tracking subdomains, running target-org-spliced employee benefits credential phishing that inserts the recipient organisation name and the recipient's own name into the body, with the call to action resolving to the sender's tracking subdomain rather than any benefits provider
116    'd2054a6e46579b0fc8989a68341493244d9d2723d99518097f9cb7658a50925a', // Attacker-controlled mailbox sending the same fabricated invoice approval thread template with zero-width joiner stuffing and executive impersonation reply-to pivots
117    'd55b15335e547cbe9a7340364887b555d8a0e77195299d49c85398eaf8da9f35', // Compromised mailbox on a long established domain sending request for quotation and bidding inquiry fraud to fire protection and alarm contractors, with the display name set to a procurement label followed by a randomly generated hexadecimal token and a dedicated attacker controlled sending subdomain
118    'd7ad624db0f99531a9ca2112fb0d6cb3fadebeb59e26bcdb31ccedba70025ef4', // Compromised account - Advance fee fraud using purchase order and humanitarian appeal pretexts
119    'da49b4eac0eb49d4f34e98c1fd42a768c3100e572579fede85eacf58141a53f5', // Attacker-registered domain - survey and prize scam with a fake address embedded in the display name, empty body text and a tracker to URL shortener redirect chain, rotating German, French and English lures
120    'da53b2817a57c3914b74d12c9bfd9a88299a52b595401bc495c3ac85cfbb5521', // Compromised education account - callback phishing fake invoice and order confirmation lures blind copied to Microsoft 365 group addresses
121    'df4256467ff64deb8d897ca705fdbbe74c6926bdb6fe6038070be15275fe8009', // Mailbox on a domain operated for fraud with no legitimate traffic observed, cycling invented broker and trading personas across portfolio introduction, broker analyst and pharmaceutical procurement solicitations
122    'e063fac3007eddb76bab1115e22aab13e729b3f8d37f573e2f2bd10361eea95d', // Compromised account at a medical practice sending Social Security Administration statement update phishing, the uncovered variant of a lure also sent from a randomised local part on the same domain
123    'e2620d4a65bea7f44f6b7ae4913e97fb3eac30be5e4fa57f0c4a3fecf6d70328', // Attacker-controlled sending identity - draft agreement electronic signature credential phishing with a randomized document token per message sent via Amazon SES
124    'e39218d8dd92ed4eabe4417733d40cfafe7de1fcce268bef9f33f624c9a90152', // Compromised account - recruiter corporate bill invoice fraud with generated PDF attachments
125    'e3e5ad599aa5c2212600c1b3e6edf0b2c9389d57e33e71e74cbdff3035d813b5', // Compromised law enforcement mailbox sending secure encrypted message lures that instruct the recipient to copy an authorisation code into a sign in prompt, delivered as image only content beneath the department's own signature block
126    'e400f4b8c7f0202052613619be78378b18080cb2efdd0fef1d437935f96db66b', // Compromised mailbox sending request for proposal lures whose only body link is a consumer link aggregator page shared with unrelated compromised senders
127    'e4698773a1b89a6bee3574d926aa4c7674ba935011837f083081628e5a489c9e', // Attacker-controlled mailbox on a recently registered privacy-protected domain sending family office investment interest business email compromise lures that reference the recipient organization by name
128    'e5834b65f9303c1ad7ca49509ab44b139dcf24ccdd68d300ebe2f8699d18d437', // German retail bank credential phish impersonating VR-Bank with zero-width characters inserted into the display name and subject to defeat brand string matching
129    'e901d770887dbe85b3be7f3bb6bc21532a0b5c52a970bc987f44dd84e1bdaff3', // Compromised account - advance fee fraud fabricating a pandemic relief compensation program alongside strategic partnership solicitations
130    'ea764503024991137afe3c4b7822ce1cad1ff6879e873ee022396a98c03d54ed', // Attacker-registered domain - Swiss commercial register confirmation fraud impersonating the EHRA federal registry authority, with a diverted freemail reply-to and the collection site reached from a sending domain whose local part exists only for this fraud
131    'f1b318f82edc36d0b9696ce19819db22fafcc591c7477cdcd9de73c0efe7f2f9', // Attacker-controlled domain registered days before use - business email compromise first contact pairing an alphanumeric reference code subject with an almost empty body to elicit a reply
132    'f1c29ee80ee521fc74775fd4e68eb32a857cc68a595dea72cbb5dc333b44e71f', // Aged domain repurposed as attacker infrastructure, sending save the date invitation lures under rotating first name display names, where the unsubscribe and privacy policy links resolve to the same credential harvesting payload as the call to action
133    'f22db0dbcc4d9b60c0562a4f2f95c505d54511a6b0ece819f2fb76010a97cf13', // Attacker-controlled domain - loan lead fraud fabricating a specific pending payout owed to the recipient to drive a personal information funnel behind a compliant commercial footer
134    'f4270634b1db3f82b346ada4223dcb47779f0134d62feca727ca5717e793fc4d', // Attacker-registered lookalike pairing a sales intelligence brand name with a payments label, sending invoice lures wrapped in a fabricated reply chain with a bracketed token appended to the subject
135    'f4acc24ba8550dd9ae5c4ae323035d9481f73f2cdf65d4d699efe1d0df3e25e9', // Recently registered attacker-controlled domain with a random character label, sending labour department and occupational safety compliance notice lures through a commercial mail service that address the recipient by email address and link to a typosquatted document review page
136    'f7fdb7d82282b9f5767f627f429ae1bed63780aa88c5c73a7c7a2884689aa595', // Compromised account on a long established domain sending outstanding invoice review lures for payment fraud
137    'f841d85aa0adac9844eeac0521c4efaa396432f73847e837cc0adf3e3b8a4966', // Compromised account - advance fee reply bait using two character subjects and two word bodies with no links or attachments, sent to government recipients
138    'f94f8d64bba11165f5b80d0e02257eaca1765ddd012b7010cfff11f80f849ee2', // Compromised academic institute mailbox sending a fake reply with no thread history and a single untrusted payload link
139    'f9b86f2c1b24b819d8748179ee44672d786d5c826a0d7c4e4385a976c5100b58', // Attacker-controlled mailbox sending American Express account notification and Internal Revenue Service tax document lures that redirect through a consumer link shortener while citing genuine agency links for legitimacy
140    'f9dd9342375749d2e019b69cafa67333d9365c7b8505b8181d9c62a0e4c6e233', // Compromised mailbox sending request for proposal lures whose only body link is a consumer link aggregator page shared with unrelated compromised senders
141    'fb6095d1a3098486ccff6cadad08a4c64de7762c17f99cc8b50a4691c2f9a164', // Compromised government education mailbox sending authentication code themed credential phishing sharing a payload host and path with sibling government senders
142    'fd86312745db2aad8aa64dc298bff3914af7d98073f0174dc4e2521c2af76d7e', // Compromised Ecuadorian mailbox sending partnership opportunity lures that share a persona and reply-to collection domain with an unrelated compromised sender
143    'fe6e6f74faa3bc783adf84b80faa9e4b95fef4e4c542169a8b087e1e7b998324', // Compromised account on a long established domain sending calendar invitation attacks with a completely empty message body, where the only content is an inline text calendar attachment and no links or text
144    'fe8cc6e6b1acc9734884b1e01f52fcaf111945c41c37d78cd9a624e66f23817a' // Attacker-registered domain behind a privacy service whose sending subdomain repeats the mailbox local part, running Japanese parcel delivery notification phishing whose subject is re-stuffed with zero width characters on each send and whose display name is wrapped in right-to-left override characters, carrying an archive attachment with a randomised file extension
145  )  
146
147attack_types:
148  - "BEC/Fraud"
149  - "Credential Phishing"
150  - "Malware/Ransomware"
151tactics_and_techniques:
152  - "Impersonation: Email address"
153  - "Social engineering"
154detection_methods:
155  - "Sender analysis"
156  - "Header analysis"
157id: "b1c2d3e4-f5a6-4b8c-9d0e-f1a2b3c4d5e6"