Observed IOC: Malicious sender email addresses
Detects inbound messages from known malicious sender email addresses. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.
Sublime rule (View on GitHub)
1name: "Observed IOC: Malicious sender email addresses"
2description: "Detects inbound messages from known malicious sender email addresses. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed."
3type: "rule"
4severity: "high"
5source: |
6 // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
7 // Managed by automated IOC system
8 type.inbound
9 and hash.sha256(sender.email.email) in (
10 '0004f01dc9ee385b299b774fbd0010c6da8164833d2ca0816ba648085e49051a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
11 '0025925158ebaf2924dc24ff2d2c31c8613e2023b5bae2101cb1e752ff187eba', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
12 '00d63ceac2fd6e0420e5b39810077268b95dc4f4596d6185fdd68a634acfa1e0', // Attacker-registered domain - BEC reconnaissance campaigns
13 '03f4447e4e825556bd7f47093b610e80f7962b0dfa62027b8e5f4315d7856d62', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
14 '04dccb790fc71da69d21ff741dc56881f76c5f04714da607df676756ce93d82b', // Compromised Russian domain - USPS survey reward phishing hosted on Google Cloud Storage
15 '054a555253046cedcbcec7ef343b0b7e3ad923a016c08c45e9346dba1bd30726', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
16 '057761a14911145dd930fac2ae3362ee5478bda82cfe87ea89aacd86a95cd6af', // Observed malicious sender - compromised SendGrid tenant, fake Teams invite credphish
17 '05ade64fe819dabde607772648db630b90b1831b31ddbd932b17e0559d59c00e', // Observed malicious sender
18 '062a0829f242e71ffaa3943294a6f4e9f504510813a5ee83c457bce0c6c74e11', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
19 '071e6532db98bebbb6d5ec4656f371c2f5237ef3ff6bc599804bd0160c7f9517', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
20 '072ad26b13508033eebde6e5070cf6d8aa09d7414d64da7b69bd82f6e8f683bb', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
21 '07447603538582dab2e8ee62920a7435cc9b756bcbc7f94054d373b6232460d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
22 '07e949af128ffe2f19d3e20b0ae03343a7b3b150d9a321201b2c7580e014ed36', // Compromised account - fake financial planning report credential phishing campaigns
23 '0a9244cdee70d32d8065e20e52c7bd8dd5f45b1c9667f0a60f8b03e1398bbf71', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
24 '0c79c4fa99676652637adf509395f6fb474922e08f1760b48d45acf37961a0a1', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
25 '0ca5c2997f598b24a2c38db307b5cb3567029b7f0decc9de88fa9b73442c1899', // Observed malicious sender
26 '0d708fdcc014db960b64ce93255c64a60884612cc2dc9c830b5638b950b4fedf', // Observed malicious sender - BEC/credential phishing campaigns
27 '0d7906e61f89af2bfbe63d749ec7681950410a81819baf307ed26a2a4ceb5605', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
28 '0d9d6401c0cffb024be34cedf19034966d01454e802cd2df9206a9eead1823a8', // Compromised account used in BEC/credential phishing campaigns
29 '0e353d693172e5409d8f7efca3f274a0f9c568142615a865ce013bb2cfdc71f7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
30 '0fe6070072580c44577931b8b61febab507e1721439481777a3c8ef218950189', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
31 '110e998853b48917bec1721e5de346da6bb59e56c81b3d7a7218521455321527', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
32 '1127c5e25e2155b4e9a1aa7ebfd0269373697032eb6d037b2b1773636620777f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
33 '12170cccd307602216eac235d3176f547ce89fb492eccbdbed19a2748f7264fb', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
34 '12e43526e75cf27e10b97b0c1d7f673028450020031ada7e21525a12ad174724', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
35 '131f2f1f4d53adf813008ef0442f741800589f6c80d2ed75022de3cbfb19699d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
36 '14f25726353bf0377a6f0dd943e3fea2ee8dae88995dcb9997560fd00d17b155', // Compromised account - Air Canada brand impersonation credential phishing campaigns
37 '163b9a33530479a7d10487a6aa5751185d49da4264329153ba609094fb22655f', // Compromised account - Japanese company domain used in BEC campaigns
38 '16527a63209b668a15eb474b91b7bbb7a5c8282e4dcd8ce68044772677855c2b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
39 '16599313a98b7432e9756a1c4ab7693b454850ba025a23a656d15ed643fe2014', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
40 '16944bb3724b4ecb0ffcfd5634fdc373b76891e6689e754154032777ebe12c6a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
41 '16f9b3c2bb2663806fe91a6c76c0033018b7d090488076cd3fd4c9bc0c3ff799', // Observed malicious sender - advance-fee investment fraud campaigns
42 '1798bdb84f24fcc6b5442071fa1c405457ea5dcc73c3f0540e4280ebec041d3e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
43 '18159738ec9f5632b7ad61fbae18fabb29ed90cbc1694be99783a67d16caa2ec', // Compromised Spanish food supplier account - RFP proposal lure with PDF attachment
44 '185d468c1a67af5f7943dfe4142e6557f027bce99c3fae3bb5c532358806df7c', // Observed malicious sender
45 '1899d688514d0651536482339e377683b86b96a0eb673de2badef384a8f7f3d4', // Attacker-registered domain - Kroger Boost membership renewal credential phishing campaigns
46 '18ac731a9858023e2b59114b6a861e10858c8d577ddf7ca7f7dd13984166a83e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
47 '19c288bd2baa150a12078d1310c3094b2ddd7fda8ba42d283be861a50615a924', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
48 '1a01ef4c29dcd924f903c6d2af54335acecf5e2289a41d69f1799005d07a8a0f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
49 '1a80fa436062f7deeea549b7f4d2b9db44c4ffef9d153fa8566a478de2876118', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
50 '1acbc86f2347911378c5803f3fff4b2db5e8355ebd1a656e7da89cea3b4479e0', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
51 '1b3f7a9f96d368268612f38aa535178ba2905ded7773a7dc15a93628bfc854e4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
52 '1daa2ca8844ce276e570e75eaf1562b79086ad846dad24108646c066b97961bf', // Compromised account - mortgage payoff and title request BEC campaigns impersonating Shellpoint and Wells Fargo
53 '1dc7009cf08e4a9891c9e9fa26201263f29826ea71bfd629400ec376a58fda00', // Compromised account - fake financial planning report credential phishing campaigns
54 '1f80dafe55a4d6adbbc05490e1957dfd24988686ca8b4b59d810845966f214dc', // Observed malicious sender
55 '1f9f044f5f4f108480264b5df8b623215c9d2e425331a22d67e6709fce0bef0a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
56 '1ff9e668661c28c3abda5d497fe4966037a01e10063bcd1d644b8ea21bca92c5', // Compromised account - Google Calendar invite document share credential phishing campaigns
57 '2040a34f81cfa9b83e25fd49aa853ea55e2af03c2f6bb521d02babc94c25359d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
58 '204eba38fc8bee6f69aec26501c467259dc7edf2bf0bab8f90ca9d73e382c38b', // Observed malicious sender - advance-fee investment and project financing fraud campaigns
59 '21052473616c4c0ccf7ef7bbd2b3d35cc082ebfa051526d86e7d359b80c4130d', // Compromised account - fake financial planning report credential phishing campaigns
60 '217fb9a42153586697f35abd87908d13cd821c1e90769b8f6601ece91455718d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
61 '236f39a7019cf6e51a95de2074e17ffc6f5552c3c6c999cf34683b88915d756f', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
62 '2383fd0534e334243246377850eda12c5a29edff93259caa91e543acef30fcf4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
63 '23c62826bbcf57ba73b802de9ff676e7c470ef20d3b6651a81b371fa3e00bbf1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
64 '23d30b83c60509d03e79c2673ab0c1b9a9fe5dda07a2198df43038cb153d7ae7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
65 '2428a08e180812cb74fb0930df94d299f444403a4cedc2fdb958e4de0ca72517', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
66 '249fdecf8c13707087a66615e8777af844873136dca22dce66955a9fa0c62f54', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
67 '26b381b3dee0a016f99bc1837a38bf87a4bd3201147c522dfe826b3ff2deafd9', // Compromised SendGrid sending account - credential phishing via fake Teams audit task notifications
68 '282e90ee0f5ded51b49c9bf06be61ae70fe455282a3719ad2dba9aff3dc9757b', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
69 '287a3feb51527264b034738d5f654c9c3f6d4d85ab8ea0f9e04defcd42c85f95', // Observed malicious sender - BEC/credential phishing campaigns
70 '298e3bbd5441f58bf33082da80ae0229cd0fa17054e3432199414a4706d05bc8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
71 '2afc248495bb3858d1f160f8cdf23f86c51e2b2d6b2799750658f48184ddbffe', // Compromised sending account - credential phishing via fake Teams audit task notifications
72 '2bca99dc80ed69d4ff757ed3259882862b107fc6ecc72ce030123954aa896182', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
73 '2c61e0a0f6d48553de52c70d5c84242ee8b550016aa6fdb36abd9c8d7daf624c', // Attacker-registered domain - fake family office investment solicitation BEC campaigns
74 '2d9d53c3991cd29ded163caaca5379f9ed2bad0e90cbee80f494a7003fc4ba29', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
75 '2ded1c3fefd56268abc47bba7573bc15cd7439037faa2b99044e205402f5ade3', // Observed malicious sender - BEC/credential phishing campaigns
76 '30497db58c2865530f352d8605072c6cdcb553d496ab237fc3196f3133795c25', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
77 '306bddcc8efbeed15553380ede95273d10438f4e4d8190963bd1cc58178560d1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
78 '3190d9232f76f2636a06b1e39d934ddd23774e978ff5a5239eb4aa9eafd5e806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
79 '36387b3610f581c3ff95f77130dc8faa8cf2046b0e610f4138bbe89651f4afff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
80 '38347ae9a4c20cbd3d4908c29e5046d2ad5026a28e7d3ce482151ac7d2bf588c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
81 '38a8e112af8d9252b3f51a8ba94003631bc4c9bf6ef60941521169382c8f546e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
82 '3a11180346d6de0d66d38dfe9482b0fd998183d30f10d02940d1caf458457d16', // Compromised account - Polish school domain used in BEC campaigns
83 '3abf8f34e546677fd2a4ec081bcd6ec11d80fcadd49e83b342a9aec6fb723231', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
84 '3c6d0480a53df3b3c3e2c27a210d99d9704e02814e1d11507e02490695eb8806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
85 '3fa83cd162a4f95f91d8cd28016dd8b1e557ee3a96e98ec0110ce7f22e387a24', // Observed malicious sender - Kroger brand impersonation credential phishing campaigns
86 '40742af9c50cbbdd54fda2fedaf88429d78e34f6df5cc0b34fe7851b354472cb', // Attacker registered domain - fake billing review credential phishing
87 '416423ad3b195a68f1f8cea67899e4eaf97428c128e2ae30c3fa607f8951c0d6', // Compromised account - Vietnamese university domain used in BEC campaigns
88 '4218528d5686b4329c1e288e27482db00b4f97b4051e5422cc9df53e89242497', // Compromised Portuguese business account - fake photo share credphish campaigns
89 '4249dea393334f7526450a59092d3ae3c2b57ce5473ac8c43700a1811b24b79a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
90 '432c7e156912e0fa9d5a3e5c387547d19920de54f563f4cbd1662382173feecc', // Compromised university student account - fake photo share spam campaigns
91 '4364378d659a6b97ddec4f37fff2c59c7fabfc4e576fb5876ac2e9bcec31d542', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
92 '43e610255bac2342a7f16f0a442962e8f9a13b90a37425d31ddbd88b058d0d9d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
93 '4547ca0494e63d10a82797da1a0b7835a90ee19961382ab3bf05bafdba7c97fd', // Observed malicious sender
94 '45c0c14258e227b8c1b8cfaad30d10351bfa68c9a5e03a52927943b4f6049eff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
95 '48736e8d6c36f5232121bc9d9f0a148a09430a3b718695ca296abcb067530284', // Compromised account - Austrian school domain used in BEC campaigns
96 '48f87ee437793b1d2f8faf51dd2a5748f7a67f67fc0b168e861beeb28f371b59', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
97 '4a58b3d01a91249092babaf3eb56cb37e84e7cfd6a6775a2329b1e5a81993fe1', // Compromised Vietnamese university account - fake photo share credphish campaigns
98 '4bbfbe585e83799ffa2106122425812356eb4ed0559fae8353614052651242ab', // Compromised account - fake financial planning report credential phishing campaigns
99 '4bd612d0513e4be9d62a13fff090a163b7fe55534ee8cd6a95b4f925d558210a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
100 '4fc1f40c3dce21cdc1416a0932cdacd9b8cf20c6cd8993c3f5784bf4d6b9fc4c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
101 '5072d99c5b7c54ed31bdacd396a646a237dc7921822f442a2d36bc63eb3ded7b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
102 '5088966877d8065394ac600df092d315bbb7e8a3ba18f1bc1e46bf12118bbc35', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
103 '50ae47f0a347fc4f9403361b5626f2397657d768196afe7378fe613e9077102f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
104 '50d289addef8c2b6b33f72f069f979042f0878135ed471d00c3a3d1070a0f3d2', // Compromised account - device code phishing via fake legal case notification hosted on UiPath cloud app
105 '521f15c8df742711d6a5e41077569037c45205d73b0ef79b6b7c7b1a947db397', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
106 '5391de7846661fb33542db455596519a99ea1e83bea306a15e8e729568338e72', // Compromised Brazilian company account - BEC wire authorization credential phishing campaigns
107 '5447e4ec5e0b1c994debe4edd595ed538edae9b1a0dfd8b9158ee3af0d958fdf', // Compromised Australian basketball organization - encrypted PDF password lures
108 '54c49afa6a2b40d9ef8cef1be579a62fd941070d5d423ed44ca02d7a75c78f99', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
109 '54e9c00529e925b43d578e8b1cb5efa2c634992ff871b98715b10d96b49c97c3', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
110 '5502acdf89fe972ba391e8aa9355919a1c3f920947169bbd23da5c6383e18433', // Attacker-registered lookalike domain - fake Google review removal scam campaigns
111 '5915f865d7aa335645d6eb8c6de4f2b555044da805cb699d7ef144ef7e4db0c1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
112 '597628907508fd4ba364bbe8113d950b95fe07511d077043c8a2b266e3cdedc7', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
113 '5a13688445cbe7a317357c3965cc5cba2db610fb18eee85c8cef43937b9d0c0f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
114 '5a3e0172e9f47403a5211107fa7bf4f9e4c123db10bce71a56dd24dab210472b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
115 '5b508f66848ab601fd3544c927b095362b884ff7c96a863e5c4ca898b25ba290', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
116 '5c5ad5fda56f9659a2c1710d37f94eb2da19e941e75d9b59ccbd85b44a7b99ed', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
117 '5c693feb863201cf47f7845815eda91bb3f5cb80d0cca995f18c939fefecf21a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
118 '5e06e423fbf619f98f0aa67b0bce107c85e8e53e65e1c9a58997b306773cfadb', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
119 '5e2e52955873f748b0ea3ba7853953efeec8e544643626b52c4f189933dc359a', // Compromised account - used in Google Calendar invite fake voicemail credential phishing campaigns
120 '5ec704a8f5f01a6fa672656573abf9c70154a1a2af0a3123406afb3091ef0537', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
121 '5ed0e370c836d1063ec5998e7f34557f33e35defd1d3b4196efbda94c8883f4e', // Compromised account - fake financial planning report credential phishing campaigns
122 '6057ccf37d8286e1ae7d8dfd1789fe60791f2bc39600631f0551712cc8661e5e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
123 '615c14f44c9280f9cf9aa5281f970a5313f131783852b454d6f9b49ec918daca', // Observed malicious sender
124 '637bfb85dc1f4f13ca89f1ecae0ea67745800e25d2ffe8a7ac89ac3fd961c944', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
125 '63fc0efb6cb07fe669b6baff257143075488f457fa2571ab86d10e5316d66483', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
126 '66771511747b19c3015adbbadd4e1d54d0db51c646f3c28b34b1fa09ee772afe', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
127 '66c1dd9579c2c6120ceef211cbde79e0bb2da9d92fc0a35d4925bcb7d0094edb', // Compromised account - used in Google Calendar invite credential phishing campaigns
128 '6743c1d4689d9c0b1f807a7ae8b69676b42a6ce33df41ec51f471afe39c13367', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
129 '6777231b6c945ebef989e3c0cfd506bd36f312e4e72759c20240f975efba3b00', // Compromised student account - fake photo share and fake forwarded thread campaigns
130 '682690942d17fcfdab558aeb4dc2731f51666adabfad813e1f4b6e3843a2c605', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
131 '68e096fe2d9e586026cbe19d4b718ab64b0f4aae0aca3021c0f77e6f5e7512ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
132 '68f31b98d1f1d9b1ba3698a155a5a47484c4e674b371c866189cb143afcd70c4', // Observed malicious sender
133 '69445041cb7a92d9283d016fe79f20ca740aa4244afa966df1f27c9c1f9ab0cd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
134 '69bb39e7e9fc344ed53bf59bf46ab39601ff098e1fe28730f5dbdb6dd5cc2e92', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
135 '6abb620f683ee3a848295b4343b27d99c8269f1b1e99061d04f292730f1c15ad', // Observed malicious sender - fake voicemail notifications via Google Calendar invites for credential phishing
136 '6ba83ae804722e49e6e3b876b5830dfe6044b5b8767aed9d5b2e2b168b835cde', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
137 '6bcb6d890034877d208a211b2b2fc4e34e477a4a588c610f7ddd6d4fcad30821', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
138 '6dd1daf7fab34d399a3307b0ab85a2c7d4ae4f9e42e0a226811f6d4d362b9d4c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
139 '6e1a4b9a4e87f3662a43c97e51763812ebc97b5e8f919a6fcb76cb1b892492e9', // Compromised Egyptian university account - thread hijacking with credential phishing link
140 '6f9a75a9a30c46798d67cf29265c8fb9255d05f9929156470c87e85a19f83254', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
141 '7044b353baffec52f9de4bb653e76485c6829328443d7fbd6f38fdd160c16055', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
142 '70855e72100e8ada3eddeacd781116929015ed87284dfdac46ec680ad4aaa193', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
143 '70e1030db9d32f156df07d445ee2bdc71fa37d3e9cde4418c5db6e2560f711cc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
144 '72d595614ffddf30da8d74c9b206c6625d24f3b66703e7d4bbe79bd6c87221ce', // Compromised sending account - credential phishing via fake Teams audit task notifications
145 '73267f82cfef50641282935512e3d291d2c681aebd58c8ba7950af8236626912', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
146 '746f335cb574668d6e435e21e98a800e6b7bf92dde423963ef5aede5712ada2b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
147 '7516a9a2ed9016192434dd81db055d23dccba29731343f12be7f7dcb324a439e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
148 '762c9ce5b716f3b385559fb09e7510661267797ea556eb866cbd1727424fdaca', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
149 '766d628cd39125d9a6bce62dff3203cdc47d1a74e83f05157ad4fd28771974cd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
150 '77161658a8ef858b15e320fe5bc309dae9aa0384ed235fbc3ad4cf5a2e725747', // Observed malicious sender
151 '778164c7dca578e67b6d2adfbd280c54f233f7321f351f7536f19ca5ec032acc', // Compromised account - used in fake voicemail notification credential phishing campaigns
152 '77dbd254b71aedc57d3247f9273b23a0ff191ebeafd4fe231048959f0191d524', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
153 '77df91f5bd3c2e212d6a97a37f9096c7066a38ef5df4da445a83a5a8f8f94500', // Compromised account - fake voicemail and remittance notice credential phishing campaigns
154 '7c8569f4156a396673e5509f5c3a4b1aaf30761802631478bd59bec9c2ff0459', // Attacker-registered domain - German language inheritance advance fee fraud campaigns
155 '7d3ecab1afc389186703af31545b4b7485ff20ad130167d641a178bf88850f1f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
156 '7f6a1cadfd6cbdc412e25021725006324d84aeb4ba3e366d772e92887937bf15', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
157 '80c2073c491f2330f6f9d87cfd0e9ca485ef3cb293c2fb8759a6edefa45ed0be', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
158 '8280e33a27a19991f81efef619f438403176fe91bbcd947df333b7eac77a092b', // Compromised Argentine company account - BEC business inquiry campaigns
159 '85041984096b0421bae2ee2f3d8b226f5d3335323af69ad44ff427059642856b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
160 '87eb1efe1ab4ff5ef8767c19f6ccd837b2dac092b70092b56e3e59302035ad84', // Observed malicious sender - Norton subscription renewal credential phishing campaigns
161 '888a5bb142e1da435425a770cb0926d4ad613f7d972c22d2e01cf9f59a0d685c', // Compromised French hospital account - advance fee fraud and BEC campaigns
162 '894310051f1fe1fde08f6254d7909481b182338dca784c0dfc4c8b71134cf776', // Attacker domain impersonating Indian bank - BEC lien waiver fraud targeting construction companies
163 '89f1d71e971311f8d39a86a1bffa3b8c66f9e4c6569050af6424ae77d45242ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
164 '8a47d2234827f5ded1d6bc235b16bf78b6f993c5799b4145888de15ba9a5e741', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
165 '8b6199148560383d2fca031052475ca2627637fdf4a883dd475c9f3a51d39887', // Attacker-registered domain - Kroger Boost membership renewal credential phishing campaigns
166 '8c4ffc408b379a7649bef8b6fe6dedf467960627897eae7742091d98fc79a263', // Attacker-registered domain - fake family office investment solicitation BEC campaigns
167 '8ccd1976165c5acf2be6d44e89c95808574b584a2289354059554ba92f3ee355', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
168 '8d0a6552bc32f3704106dcbdd393c73ceb29a4bbfd7f0ec207ea438c757b608e', // Compromised Vietnamese bank account - advance fee fraud gift and prize campaigns
169 '8d6d35f92d52490cfd8c2153a979604b95aabb430eef256486600075465e80b8', // Compromised Kenyan school account - thread hijacking with credential phishing link
170 '8e54f90fa7e47835cbb71d612b21b611fae8646c152b17041c5834d331cc4fed', // Observed malicious sender
171 '8f70301abb6faa9b1b0463bda1a42a153a49c849dae45c24ca087b49cbd6f16f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
172 '904e10d30ea2b3ba2f2a8b79645b18998e47d13258a03577242d65b3367fbd10', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
173 '91af23121133f55ed3e3daa4f519c76565806472292d4cedbc2c2ceda0aff059', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
174 '92b022313ffa3406da6cb095c2f8aa3404b401fea6ff9786f748663b9da6539f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
175 '9308f38304b1c6734b5af78a959120435650e408854fc5fb98e0d9f8d4ed4a79', // Compromised account - used in fake bid invitation credential phishing campaigns
176 '9472ab67914ca4eb86fb7c4b726bef67c194bbbd430871570e53ba148099c502', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
177 '949999f91a3feac5a7b82ce881d1a32f8aea674ff928f5a7f8950076033272d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
178 '94a586de7ec274964f27506d5f27a6d717a1d472306017737ea067830889fb98', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
179 '95f01da32fea6a5c28b5453568b7d3977a76e3ae42e7375534f22cd5c43c089a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
180 '99563d51af8f00be8f300763fd1a9dd2a1b38bf4d7d5d1fa370384a1f914f712', // Compromised account - German language inheritance advance fee fraud impersonating Bank of England
181 '99673797051adaeb68dc8b07624ba300472cf9cff1a995fa1f95d8b6685374dc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
182 '9b3afc720c7975523f572be5e2b8e75a2567257a834e73ba3c11eeae4c53467b', // Attacker domain - fake eForm/spreadsheet sharing via SendGrid abuse
183 '9b4bc1752d36bb4718a2a30342761e8ccecb5d64dc9164c3127dab30614811d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
184 '9b63750b1536d04005384932eb91499527e5f8ce9f7c8508ed7fe52e4060b0bd', // Observed malicious sender
185 '9da7b0641362e72b2db1ac186183e105c337696be87a2c8c1d3bee3e471f92fb', // Compromised account - US medical center domain used in RFP/proposal lure campaigns
186 '9e42f010967e7707cee3452bc8b9707df429c34be2dfc1ec3014392f696cb2c2', // Compromised account - used in Google Calendar invite RFP credential phishing campaigns
187 '9ee9228bc6dcb8628d144d63c21d436f427719672dc1ff01e9f5845059424ea6', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
188 '9fda882aad59efabf9e2c45a9f1490e87deb323de5aedcf80b4bfbbf1c21f8b0', // Compromised account - fake eDocument task and Teams share credential phishing campaigns
189 'a0d86d57f426c19a119f6aa3126ffcdc26f86f56d40824896ac168354a8318a5', // Compromised government health service account - BEC purchase order inquiry campaigns
190 'a0d8f3435d51f1e452dd4cc99f533b718d52f32ceee0e4311fa0b721368b634b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
191 'a18ddb2b10a3a42bbbbc6300dce305703607cf9a12ed737da9f5576b879b1113', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
192 'a25568f7bea934cb12b3a5640e711701fc648b5d329c39f97af299e48f18451c', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
193 'a2bbaa6824197630b7b9fb12296405481f6d2224194559c1ee39a635f8603cfc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
194 'a3e2ac92f5de8d20c54480ab3a61f33be788de8e9467bc18fc5e0b6a0d6da2ed', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
195 'a484fa16fb013b579b1f4006cc42d20da09541271c5f93312b4d02dbeba8385f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
196 'a4f740abf0fa1c0a6c26a9acdff1248e6cd147b392b5806028515ae3da389785', // Attacker-registered domain - fake family office investment solicitation BEC campaigns
197 'a54656301522393c85cb9f5ff2abb734120f7f957fa5e750730d8966bc2cb4bf', // Compromised Polish school account - fake photo share spam campaigns
198 'a5e72048f261715f3e7ce6d2cc8916bd2a3e230e5dba3f6bfa3fbf8756ac7381', // Attacker-registered domain - fake family office investment solicitation BEC campaigns
199 'a61e3cfff46af4b989c3b9ef15fc530d49b02833387503277c25701dc8240ed1', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
200 'a73aa957cd96d7cf65c2933636a5b88a10bd9223f43a493d7d030a67efab3e57', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
201 'a74606dc787d5e75866029b343dd8c08f083d8f9b086362b9fb20f071e79a12b', // Observed malicious sender - BEC/credential phishing campaigns
202 'a867247b8ccfc2299abe14585264d8a09bc1786f8ca4e2340ebf7c276b0b9af7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
203 'a92c27104a2bd50691964990abd72d2115b676d1f840a27699b9c505290108f7', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
204 'a9f9953ba7510a4ab38bc4602914b2d2aeb2679164494d984ca68b9e1b7d869b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
205 'abd5ceb9b3abbd53544b99ded01b9a993c38b3133b0905d62006f8d378e5f8d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
206 'ac3af7bc7aa52ad34365f7659070dc858ad4eb09aaa9f9177ba37adbdbf60a48', // Observed malicious sender - abused aged domain (SPF none), HR/payroll credphish via encrypted-PDF password lure
207 'aee561d4926ae4535a732b4649ea27a5ccef7a18b28775b162d095e11820a52c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
208 'b10df2f1de40412802796ec5895eff9c92880f378aa4f301608cc5dab1fc7515', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
209 'b282f3e253bf6a2aa02d484f2edacc2f20338ce37fe157d8817ba96321af6766', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
210 'b2dfca515de73047279efe855337aa3c7d6179f7b0d7dc35921fb0377b618baf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
211 'b3413ce41fc413b11ba8fd0b58c71e3a811169cc2ac783154eaaf37e84fe7bbe', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
212 'b3e89ebfcc45a1fd5f254b8d04c5275d968af4618a7a8c5f6cc75b8d941bd448', // Compromised real account used in VIP-impersonation invoice/payment BEC with fabricated reply threads
213 'b3ed5ef14f1be181d2e375ad4d3d29a3b0777ec5fd162c9c36422962d2dcfd7c', // Observed malicious sender - BEC/credential phishing campaigns
214 'b45eb5412cc803dec77d6c7abea7ce0e6e3abc72ec75ac19a4f16c9cee65b91b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
215 'b4751533eefe4d0cc630fd5dce52e043a1ff6617238b2ebe3b7290899bbe241f', // Observed malicious sender - Kroger brand impersonation credential phishing campaigns
216 'b53cf0459ca41ca4c51c15d4be23113aeee4d77a77f7f01761e416b6896011b9', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
217 'b5a9dd56b5f7bc80c19c1f82b1bceb2d7e8bf42c1edf22346454c7c3a337d399', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
218 'b6df58873af5b6edde8f19e46bd7ed10bd0c7b61d4adda29506b05c5f0ef057a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
219 'b7281cf68223954ebe25b926a93d4073fa160430de9d90546bde6c34ff1418c5', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
220 'b8be174108d56e82b8cb5fe1c47d7bb4ae4fe5a75b76e96e814d730d68200f44', // Compromised account - used in Google Calendar invite credential phishing campaigns
221 'b8d42ba17d0fe7957537b0d1cf25530bd722f3f998c520d5f148b3cc861cb881', // Observed malicious sender
222 'bb24567ae519d6391aba7c28597fbf84a1c9b283bcd9e8d9383e4345c7ee0dcf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
223 'be44430a667b7776e351cf54a66f85716de0731dcb1245b7c5bca081e4cd80a5', // Observed malicious sender
224 'bf5d4be8d2cee2476e9a226bd955f41819e4b01976f9bbd91b58bc82f057d4f6', // Observed malicious sender
225 'c118eb58bedb809f3d4e2eaed00cc27768f64f155497f7cec47ef57b545bca99', // Compromised account - Japanese company domain used in BEC campaigns
226 'c36ab707c4867b70407bfc0d9a4b069350080fdc820626f9a54f88ca905a3c97', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
227 'c43bfeb172551e7a4f9ad23862e3b6d743328973acd29a5e2fc245d6cec78ea6', // Observed malicious sender
228 'c58703f9493a1ba83cfce49fc8afb2fbfc7442ea87abdeb74727a6b21e81d5ec', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
229 'c6d327e24a56cf67283301d3f77f0cdac3e65d8d3f1f611779d92032edfb319a', // Compromised account - agreement finalization e-signature credential phishing campaigns
230 'c7c688e8204b906d36f4ce1f8bab9238a5eed71d0e5021ac9966c63df027c2bc', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
231 'ca2e7c13010d96bf2286342dc7ea87ec67232e29b5e659820210e01cef273081', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
232 'cba8a0af5e7215c47dff6acf2a2e5bd0a52db3b52ba1bb6ced691087bfe5d593', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
233 'ce2be5b5f5f2e6d1d9d8619c832e94cfa804ce4839d834d1af510a769e7a7d16', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
234 'cf75ac0cb2baeaa1bf657101ca7ae0c300398509298f615e3d05fea7216da05c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
235 'cfa974b119ad8212b484a0229914ff1405ca9b8c7489166420986b3576b7da7d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
236 'cfe6deedfb19c2b10e7b4d141a75421e34e846545dcbd4da67ccca4c28336cb2', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
237 'd727d5b6cb6239d9d7a5549862d2fcbafe79efefe8f5f98f91d716a86653c06f', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
238 'd74e6eddf9abd425d77adced3fb56eb96a164b2a56a28e0d75d08ede43d51cd4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
239 'd7a310ef6cb3f4e842b17d268a52391675477f71475b63a4cf1cee6f9bd94ff5', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
240 'd86903bff85599facfd0e178670e77f500fb5fa84ca2aafa20f245c0a6e0aa05', // Observed malicious sender - BEC/credential phishing campaigns
241 'd8a51f45c253a7032e8192237f8a8a070670f1631c5943a6bbd49dff5fef22a4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
242 'd9a21bdddc5bfebedafb827c71e3d014b64e68c18911e74a298352d7cc1fc552', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
243 'd9b1a194be864f755ad19767c53bfc54dd27fb69464fc9d6b0729f4f82267f42', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
244 'da8c55140d24bc5ea5f26c2712e84166241145cc7e9c950a79a8b7bf474a0200', // Compromised account - Spanish company domain used in credential phishing
245 'da9493072c014db09e8b4a0d01e179df192799577a99483acc4a6a3af7617fb4', // Compromised Brazilian school student account - fake photo share spam campaigns
246 'db29e93aaac356acb1ff4fda884fd21809492889fe6af7d0f0a17f1e7ee2d62e', // Observed malicious sender
247 'dc01b1e4b74adb29a9e2ff4f29a34076f61c87cf04f620cef525d5070818687c', // Observed malicious sender - advance-fee investment fraud campaigns
248 'e02c4ad389225617a5fe12c012348a928f6c2159b378afb28d4d1f5f1e541376', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
249 'e1509d8bf5ad644ed6eb5eb8cde1c5962ed8a3c18142ee753d24b185705facff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
250 'e1a4513ed83d89a26bd5216b871b8bfda892e5cce47f539a0c04f36e93cc0077', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
251 'e2dd8628371377d56c761817ed6676c5ccd2e9870f1b8cb7b63467f0d387d8fd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
252 'e33298b339846b18124a523b0d065abd21f7f8ca167f0f18a759add3cc06cb93', // Compromised Brazilian company account - BEC wire authorization credential phishing campaigns
253 'e4e85ae5800109afd8bf3d353b16206f3b68cb92447172ca88c317e62a6634a2', // Compromised account - used in Google Calendar invite fake voicemail credential phishing campaigns
254 'e7c699fb15764decb4193d06537fd56d2ebb7e6af19919dd9b489815c200ea2c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
255 'e8a9768b0450f6383b427808fa6855e617e0f2210cfad339879a25f194aca25d', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
256 'ea32f0fb78dd6c1355f2060946aa7ca21d23e7d21c2e726c0077427afe01f25a', // Compromised Turkish manufacturer service account - thread hijacking with credential phishing redirect
257 'eb6fdf648b34efa0d7eed5ac971d12d2fbc5d8f8fa3c5d3abe7d307b3f1367f2', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
258 'ed227a85dd447f006e6c34ffe955bfbfd864b88e0ef91ddfc1c7f5546bdf6f90', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
259 'eead3a313696ced0b6427ca8b82e7065630e774865142111347f4da4c5634e82', // Compromised account - fake voicemail and remittance notice credential phishing campaigns
260 'eeb6b71f9c3090dedbd6018df4edeb5d4c86f4819ab0223654ad44c32bac3503', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
261 'f0d099bfdabc2c0ac8f8561a64d66e9e6ee1207fc560db8fe07771fbfa4bdd52', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
262 'f12e13befd897b6b9ea41f1b299200fd71fb5137d6c0866f5af0984ac91a30cf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
263 'f31d0f49475966eea47015c6ef2888a2d8805eef2df40805808ded010183f170', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
264 'f4116dde162ca98aeabba276d40e2d7306b4a63332b67dc994bf9278452a2c60', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
265 'f47441d1d8080fd855a7ebc8ba3549958929f7d2acc70417438319bab03531bf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
266 'f4db533881dd346485a0167dc80828daa28a8c2079f513041c813da3545c68a8', // Observed malicious sender
267 'f54e3fec312d54805af30d336914a7efc535fab22d057674442434c76702f36f', // Compromised account - fake financial planning report credential phishing campaigns
268 'f693fc266ddb82491f9b4fd1cfbb727fe8a76713a9f70095dd9ff8452416ab62', // Compromised Puerto Rico nonprofit account - image-based legal subpoena lure targeting accounts payable
269 'f994c522d9fc5386e1632cff88140e6159efc67021460d7bb798fcf16a396767', // Observed malicious sender
270 'fa0038a882392e5496003d074ba4f627b377efe20e2cbe8aad9b8547b9222771', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
271 'fa1bdeb8ab383c6be062634d07eacf3611cafcfc43dc0472b20abf13062c7e05', // Compromised account - fake financial planning report credential phishing campaigns
272 'fa8ac775c0747999f0733c1197e1540b5db9e456a36014347c880b03a3b2aada', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
273 'fc9c6b86c01d295f937e9a46e385acac640b876d923d2400befeabdd5db3797c', // Compromised account - fake voicemail and remittance notice credential phishing campaigns
274 'fcbac7976a502038193be95362557c9808746ff4830a570376056340a4087857', // Spoofed legitimate Harvard domain via Amazon SES for BEC/credential phishing campaigns
275 'fd0a02e65301f811a3a46623232053d9751380e5339386b459d4bd668e6a2f81', // Observed malicious sender
276 'fe0327623c71abe970f70c79062ccf66021adcc266fab760ed7d79d65df2221c', // Observed malicious sender - BEC/credential phishing campaigns
277 'fe08399f0400a0dab9349c6e3ad82bf1a6b70c3578fc519ea330964c918ec210', // Attacker typosquat domain impersonating Fidelity Investments - fake security alerts
278 'fe766eccc0c02f9ecfb6a9a326a1d77a91a3cee2151680befda2630eb8e128a9', // Observed malicious sender - lookalike law firm domain used in fake insurance policy document campaigns
279 'fff3c2530f6cc63385b2de940cc3e2c471561a3e5c28f77c650f203f1e86d6f0' // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
280 )
281
282attack_types:
283 - "BEC/Fraud"
284 - "Credential Phishing"
285 - "Malware/Ransomware"
286tactics_and_techniques:
287 - "Impersonation: Email address"
288 - "Social engineering"
289detection_methods:
290 - "Sender analysis"
291 - "Header analysis"
292id: "b1c2d3e4-f5a6-4b8c-9d0e-f1a2b3c4d5e6"