Observed IOC: Malicious sender email addresses
Detects inbound messages from known malicious sender email addresses. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.
Sublime rule (View on GitHub)
1name: "Observed IOC: Malicious sender email addresses"
2description: "Detects inbound messages from known malicious sender email addresses. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed."
3type: "rule"
4severity: "high"
5source: |
6 // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
7 // Managed by automated IOC system
8 type.inbound
9 and hash.sha256(sender.email.email) in (
10 '0004f01dc9ee385b299b774fbd0010c6da8164833d2ca0816ba648085e49051a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
11 '0025925158ebaf2924dc24ff2d2c31c8613e2023b5bae2101cb1e752ff187eba', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
12 '00b060930b9543a8e53680eeec51b8f0ea26171f841ba405b6a2bae4f4a16d13', // Observed malicious sender
13 '01fb95a71c2e61353d73ad4b540297927f8c3c94cf82605e0362e9e08919241b', // Observed malicious sender
14 '03f4447e4e825556bd7f47093b610e80f7962b0dfa62027b8e5f4315d7856d62', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
15 '04ad2551e2fb00d428e8ea108ee3a793a68d4bdb23507909059d32456bc89175', // Observed malicious sender
16 '054a555253046cedcbcec7ef343b0b7e3ad923a016c08c45e9346dba1bd30726', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
17 '062a0829f242e71ffaa3943294a6f4e9f504510813a5ee83c457bce0c6c74e11', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
18 '071e6532db98bebbb6d5ec4656f371c2f5237ef3ff6bc599804bd0160c7f9517', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
19 '072ad26b13508033eebde6e5070cf6d8aa09d7414d64da7b69bd82f6e8f683bb', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
20 '07447603538582dab2e8ee62920a7435cc9b756bcbc7f94054d373b6232460d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
21 '0a9244cdee70d32d8065e20e52c7bd8dd5f45b1c9667f0a60f8b03e1398bbf71', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
22 '0bc24e314a84b7c97d4afae97511506aca1cebaf481a906e20e264beb8ea7da7', // Observed malicious sender
23 '0c79c4fa99676652637adf509395f6fb474922e08f1760b48d45acf37961a0a1', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
24 '0cb0ec45f1392918c2f720f262df8883ae5feb7f3f7fcab3e39a0c659dd29e55', // Observed malicious sender
25 '0d7906e61f89af2bfbe63d749ec7681950410a81819baf307ed26a2a4ceb5605', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
26 '0e200a346995e3b0b8a339ddd57f439ce8d4961a5530ce4d8becbd17db562b08', // Observed malicious sender
27 '0e353d693172e5409d8f7efca3f274a0f9c568142615a865ce013bb2cfdc71f7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
28 '0efd3093b90370fa035b187a710e1bc2ae85705850260c3efdcf0e887ff8c9db', // Observed malicious sender
29 '0fe6070072580c44577931b8b61febab507e1721439481777a3c8ef218950189', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
30 '110e998853b48917bec1721e5de346da6bb59e56c81b3d7a7218521455321527', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
31 '1127c5e25e2155b4e9a1aa7ebfd0269373697032eb6d037b2b1773636620777f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
32 '12170cccd307602216eac235d3176f547ce89fb492eccbdbed19a2748f7264fb', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
33 '12e43526e75cf27e10b97b0c1d7f673028450020031ada7e21525a12ad174724', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
34 '131f2f1f4d53adf813008ef0442f741800589f6c80d2ed75022de3cbfb19699d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
35 '16527a63209b668a15eb474b91b7bbb7a5c8282e4dcd8ce68044772677855c2b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
36 '16599313a98b7432e9756a1c4ab7693b454850ba025a23a656d15ed643fe2014', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
37 '16944bb3724b4ecb0ffcfd5634fdc373b76891e6689e754154032777ebe12c6a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
38 '1798bdb84f24fcc6b5442071fa1c405457ea5dcc73c3f0540e4280ebec041d3e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
39 '18ac731a9858023e2b59114b6a861e10858c8d577ddf7ca7f7dd13984166a83e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
40 '19c288bd2baa150a12078d1310c3094b2ddd7fda8ba42d283be861a50615a924', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
41 '1a01ef4c29dcd924f903c6d2af54335acecf5e2289a41d69f1799005d07a8a0f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
42 '1a80fa436062f7deeea549b7f4d2b9db44c4ffef9d153fa8566a478de2876118', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
43 '1acbc86f2347911378c5803f3fff4b2db5e8355ebd1a656e7da89cea3b4479e0', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
44 '1b3f7a9f96d368268612f38aa535178ba2905ded7773a7dc15a93628bfc854e4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
45 '1b7110520c715083c62cefd91b7129525ad1fcf5512fb78847e8eb16747ecd93', // Observed malicious sender
46 '1f9f044f5f4f108480264b5df8b623215c9d2e425331a22d67e6709fce0bef0a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
47 '2040a34f81cfa9b83e25fd49aa853ea55e2af03c2f6bb521d02babc94c25359d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
48 '217fb9a42153586697f35abd87908d13cd821c1e90769b8f6601ece91455718d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
49 '236f39a7019cf6e51a95de2074e17ffc6f5552c3c6c999cf34683b88915d756f', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
50 '2383fd0534e334243246377850eda12c5a29edff93259caa91e543acef30fcf4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
51 '23c62826bbcf57ba73b802de9ff676e7c470ef20d3b6651a81b371fa3e00bbf1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
52 '23d30b83c60509d03e79c2673ab0c1b9a9fe5dda07a2198df43038cb153d7ae7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
53 '23d51790ce4482897006c98b3ad51e89731120ff5ffe550ef4e465495a6540bd', // Observed malicious sender
54 '2428a08e180812cb74fb0930df94d299f444403a4cedc2fdb958e4de0ca72517', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
55 '249fdecf8c13707087a66615e8777af844873136dca22dce66955a9fa0c62f54', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
56 '273ead1b544583c83904a980ac566ca06c890ab5ce3e3099479d16ef8ee56421', // Observed malicious sender
57 '282e90ee0f5ded51b49c9bf06be61ae70fe455282a3719ad2dba9aff3dc9757b', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
58 '298e3bbd5441f58bf33082da80ae0229cd0fa17054e3432199414a4706d05bc8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
59 '2bca99dc80ed69d4ff757ed3259882862b107fc6ecc72ce030123954aa896182', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
60 '2d9d53c3991cd29ded163caaca5379f9ed2bad0e90cbee80f494a7003fc4ba29', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
61 '30497db58c2865530f352d8605072c6cdcb553d496ab237fc3196f3133795c25', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
62 '306bddcc8efbeed15553380ede95273d10438f4e4d8190963bd1cc58178560d1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
63 '3190d9232f76f2636a06b1e39d934ddd23774e978ff5a5239eb4aa9eafd5e806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
64 '36387b3610f581c3ff95f77130dc8faa8cf2046b0e610f4138bbe89651f4afff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
65 '38347ae9a4c20cbd3d4908c29e5046d2ad5026a28e7d3ce482151ac7d2bf588c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
66 '38a8e112af8d9252b3f51a8ba94003631bc4c9bf6ef60941521169382c8f546e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
67 '3abf8f34e546677fd2a4ec081bcd6ec11d80fcadd49e83b342a9aec6fb723231', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
68 '3c6d0480a53df3b3c3e2c27a210d99d9704e02814e1d11507e02490695eb8806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
69 '4249dea393334f7526450a59092d3ae3c2b57ce5473ac8c43700a1811b24b79a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
70 '4364378d659a6b97ddec4f37fff2c59c7fabfc4e576fb5876ac2e9bcec31d542', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
71 '43e610255bac2342a7f16f0a442962e8f9a13b90a37425d31ddbd88b058d0d9d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
72 '45c0c14258e227b8c1b8cfaad30d10351bfa68c9a5e03a52927943b4f6049eff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
73 '45df5110a927dc6160ee706784b4b3f75bc3f9154c75b3c28a524501a25943f5', // Observed malicious sender
74 '48f87ee437793b1d2f8faf51dd2a5748f7a67f67fc0b168e861beeb28f371b59', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
75 '4bd612d0513e4be9d62a13fff090a163b7fe55534ee8cd6a95b4f925d558210a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
76 '4fc1f40c3dce21cdc1416a0932cdacd9b8cf20c6cd8993c3f5784bf4d6b9fc4c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
77 '5072d99c5b7c54ed31bdacd396a646a237dc7921822f442a2d36bc63eb3ded7b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
78 '5088966877d8065394ac600df092d315bbb7e8a3ba18f1bc1e46bf12118bbc35', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
79 '50ae47f0a347fc4f9403361b5626f2397657d768196afe7378fe613e9077102f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
80 '521f15c8df742711d6a5e41077569037c45205d73b0ef79b6b7c7b1a947db397', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
81 '54c49afa6a2b40d9ef8cef1be579a62fd941070d5d423ed44ca02d7a75c78f99', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
82 '54e9c00529e925b43d578e8b1cb5efa2c634992ff871b98715b10d96b49c97c3', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
83 '5915f865d7aa335645d6eb8c6de4f2b555044da805cb699d7ef144ef7e4db0c1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
84 '597628907508fd4ba364bbe8113d950b95fe07511d077043c8a2b266e3cdedc7', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
85 '5a13688445cbe7a317357c3965cc5cba2db610fb18eee85c8cef43937b9d0c0f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
86 '5a3e0172e9f47403a5211107fa7bf4f9e4c123db10bce71a56dd24dab210472b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
87 '5ab4530f353445bc3cd68b1131cb77abf71cbf2490f777190e2db6ff21fab7d1', // Observed malicious sender
88 '5b508f66848ab601fd3544c927b095362b884ff7c96a863e5c4ca898b25ba290', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
89 '5b5be14defe0402d391348747d654cefa42685470bcea9080c1db55a7beacddb', // Observed malicious sender email
90 '5c5ad5fda56f9659a2c1710d37f94eb2da19e941e75d9b59ccbd85b44a7b99ed', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
91 '5c693feb863201cf47f7845815eda91bb3f5cb80d0cca995f18c939fefecf21a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
92 '5e06e423fbf619f98f0aa67b0bce107c85e8e53e65e1c9a58997b306773cfadb', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
93 '5ec704a8f5f01a6fa672656573abf9c70154a1a2af0a3123406afb3091ef0537', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
94 '6057ccf37d8286e1ae7d8dfd1789fe60791f2bc39600631f0551712cc8661e5e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
95 '637bfb85dc1f4f13ca89f1ecae0ea67745800e25d2ffe8a7ac89ac3fd961c944', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
96 '63fc0efb6cb07fe669b6baff257143075488f457fa2571ab86d10e5316d66483', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
97 '66771511747b19c3015adbbadd4e1d54d0db51c646f3c28b34b1fa09ee772afe', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
98 '6743c1d4689d9c0b1f807a7ae8b69676b42a6ce33df41ec51f471afe39c13367', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
99 '682690942d17fcfdab558aeb4dc2731f51666adabfad813e1f4b6e3843a2c605', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
100 '68e096fe2d9e586026cbe19d4b718ab64b0f4aae0aca3021c0f77e6f5e7512ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
101 '69445041cb7a92d9283d016fe79f20ca740aa4244afa966df1f27c9c1f9ab0cd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
102 '69bb39e7e9fc344ed53bf59bf46ab39601ff098e1fe28730f5dbdb6dd5cc2e92', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
103 '6a185db48b17bb707ad12cb0839babf4eebd45c2e648fb5606afb16fb64f9f4c', // Observed malicious sender
104 '6ba83ae804722e49e6e3b876b5830dfe6044b5b8767aed9d5b2e2b168b835cde', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
105 '6bcb6d890034877d208a211b2b2fc4e34e477a4a588c610f7ddd6d4fcad30821', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
106 '6dd1daf7fab34d399a3307b0ab85a2c7d4ae4f9e42e0a226811f6d4d362b9d4c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
107 '6f9a75a9a30c46798d67cf29265c8fb9255d05f9929156470c87e85a19f83254', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
108 '7044b353baffec52f9de4bb653e76485c6829328443d7fbd6f38fdd160c16055', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
109 '70855e72100e8ada3eddeacd781116929015ed87284dfdac46ec680ad4aaa193', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
110 '70e1030db9d32f156df07d445ee2bdc71fa37d3e9cde4418c5db6e2560f711cc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
111 '73267f82cfef50641282935512e3d291d2c681aebd58c8ba7950af8236626912', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
112 '746f335cb574668d6e435e21e98a800e6b7bf92dde423963ef5aede5712ada2b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
113 '7516a9a2ed9016192434dd81db055d23dccba29731343f12be7f7dcb324a439e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
114 '762c9ce5b716f3b385559fb09e7510661267797ea556eb866cbd1727424fdaca', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
115 '766d628cd39125d9a6bce62dff3203cdc47d1a74e83f05157ad4fd28771974cd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
116 '77dbd254b71aedc57d3247f9273b23a0ff191ebeafd4fe231048959f0191d524', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
117 '7d3ecab1afc389186703af31545b4b7485ff20ad130167d641a178bf88850f1f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
118 '7ecd366c4bc3213afe9374bf72d1e8151c1fcba1d1de800a7b9d9f58796835d1', // Observed malicious sender
119 '7f6a1cadfd6cbdc412e25021725006324d84aeb4ba3e366d772e92887937bf15', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
120 '8030cd12e522cf160c85171bfaee999d095e79bd66815d4604f5e4406a1c566c', // Observed malicious sender - multiple cred phish lures
121 '80c2073c491f2330f6f9d87cfd0e9ca485ef3cb293c2fb8759a6edefa45ed0be', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
122 '85041984096b0421bae2ee2f3d8b226f5d3335323af69ad44ff427059642856b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
123 '89f1d71e971311f8d39a86a1bffa3b8c66f9e4c6569050af6424ae77d45242ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
124 '8a47d2234827f5ded1d6bc235b16bf78b6f993c5799b4145888de15ba9a5e741', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
125 '8b40a21077bb1d0807c9535d84fde1087d946d7a88b9025fe018bbdc6f08f23d', // Observed malicious sender
126 '8ccd1976165c5acf2be6d44e89c95808574b584a2289354059554ba92f3ee355', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
127 '8f70301abb6faa9b1b0463bda1a42a153a49c849dae45c24ca087b49cbd6f16f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
128 '904e10d30ea2b3ba2f2a8b79645b18998e47d13258a03577242d65b3367fbd10', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
129 '91af23121133f55ed3e3daa4f519c76565806472292d4cedbc2c2ceda0aff059', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
130 '92b022313ffa3406da6cb095c2f8aa3404b401fea6ff9786f748663b9da6539f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
131 '9472ab67914ca4eb86fb7c4b726bef67c194bbbd430871570e53ba148099c502', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
132 '949999f91a3feac5a7b82ce881d1a32f8aea674ff928f5a7f8950076033272d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
133 '94a586de7ec274964f27506d5f27a6d717a1d472306017737ea067830889fb98', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
134 '95f01da32fea6a5c28b5453568b7d3977a76e3ae42e7375534f22cd5c43c089a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
135 '99673797051adaeb68dc8b07624ba300472cf9cff1a995fa1f95d8b6685374dc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
136 '9b4bc1752d36bb4718a2a30342761e8ccecb5d64dc9164c3127dab30614811d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
137 '9ee9228bc6dcb8628d144d63c21d436f427719672dc1ff01e9f5845059424ea6', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
138 'a0d8f3435d51f1e452dd4cc99f533b718d52f32ceee0e4311fa0b721368b634b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
139 'a18ddb2b10a3a42bbbbc6300dce305703607cf9a12ed737da9f5576b879b1113', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
140 'a25568f7bea934cb12b3a5640e711701fc648b5d329c39f97af299e48f18451c', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
141 'a2bbaa6824197630b7b9fb12296405481f6d2224194559c1ee39a635f8603cfc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
142 'a3e2ac92f5de8d20c54480ab3a61f33be788de8e9467bc18fc5e0b6a0d6da2ed', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
143 'a484fa16fb013b579b1f4006cc42d20da09541271c5f93312b4d02dbeba8385f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
144 'a61e3cfff46af4b989c3b9ef15fc530d49b02833387503277c25701dc8240ed1', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
145 'a73aa957cd96d7cf65c2933636a5b88a10bd9223f43a493d7d030a67efab3e57', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
146 'a867247b8ccfc2299abe14585264d8a09bc1786f8ca4e2340ebf7c276b0b9af7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
147 'a92c27104a2bd50691964990abd72d2115b676d1f840a27699b9c505290108f7', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
148 'a9f9953ba7510a4ab38bc4602914b2d2aeb2679164494d984ca68b9e1b7d869b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
149 'abd5ceb9b3abbd53544b99ded01b9a993c38b3133b0905d62006f8d378e5f8d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
150 'aee561d4926ae4535a732b4649ea27a5ccef7a18b28775b162d095e11820a52c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
151 'b10df2f1de40412802796ec5895eff9c92880f378aa4f301608cc5dab1fc7515', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
152 'b2051a0fd6b19df331f4ee71671c8a6fc621544fb046574edd8233a585247d0a', // Observed malicious sender
153 'b282f3e253bf6a2aa02d484f2edacc2f20338ce37fe157d8817ba96321af6766', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
154 'b2dfca515de73047279efe855337aa3c7d6179f7b0d7dc35921fb0377b618baf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
155 'b3413ce41fc413b11ba8fd0b58c71e3a811169cc2ac783154eaaf37e84fe7bbe', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
156 'b3e89ebfcc45a1fd5f254b8d04c5275d968af4618a7a8c5f6cc75b8d941bd448', // Compromised real account used in VIP-impersonation invoice/payment BEC with fabricated reply threads
157 'b45eb5412cc803dec77d6c7abea7ce0e6e3abc72ec75ac19a4f16c9cee65b91b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
158 'b53cf0459ca41ca4c51c15d4be23113aeee4d77a77f7f01761e416b6896011b9', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
159 'b5a9dd56b5f7bc80c19c1f82b1bceb2d7e8bf42c1edf22346454c7c3a337d399', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
160 'b6df58873af5b6edde8f19e46bd7ed10bd0c7b61d4adda29506b05c5f0ef057a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
161 'b7281cf68223954ebe25b926a93d4073fa160430de9d90546bde6c34ff1418c5', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
162 'bb24567ae519d6391aba7c28597fbf84a1c9b283bcd9e8d9383e4345c7ee0dcf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
163 'c36ab707c4867b70407bfc0d9a4b069350080fdc820626f9a54f88ca905a3c97', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
164 'c58703f9493a1ba83cfce49fc8afb2fbfc7442ea87abdeb74727a6b21e81d5ec', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
165 'c7c688e8204b906d36f4ce1f8bab9238a5eed71d0e5021ac9966c63df027c2bc', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
166 'ca2e7c13010d96bf2286342dc7ea87ec67232e29b5e659820210e01cef273081', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
167 'cba8a0af5e7215c47dff6acf2a2e5bd0a52db3b52ba1bb6ced691087bfe5d593', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
168 'ce2be5b5f5f2e6d1d9d8619c832e94cfa804ce4839d834d1af510a769e7a7d16', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
169 'cf75ac0cb2baeaa1bf657101ca7ae0c300398509298f615e3d05fea7216da05c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
170 'cfa974b119ad8212b484a0229914ff1405ca9b8c7489166420986b3576b7da7d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
171 'cfe6deedfb19c2b10e7b4d141a75421e34e846545dcbd4da67ccca4c28336cb2', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
172 'd1105548f3549d3e676268efbdf0f0a419cba259317738f3a322f68a3b042461', // Observed malicious sender
173 'd727d5b6cb6239d9d7a5549862d2fcbafe79efefe8f5f98f91d716a86653c06f', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
174 'd74e6eddf9abd425d77adced3fb56eb96a164b2a56a28e0d75d08ede43d51cd4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
175 'd7a310ef6cb3f4e842b17d268a52391675477f71475b63a4cf1cee6f9bd94ff5', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
176 'd8a51f45c253a7032e8192237f8a8a070670f1631c5943a6bbd49dff5fef22a4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
177 'd9a21bdddc5bfebedafb827c71e3d014b64e68c18911e74a298352d7cc1fc552', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
178 'd9b1a194be864f755ad19767c53bfc54dd27fb69464fc9d6b0729f4f82267f42', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
179 'e02c4ad389225617a5fe12c012348a928f6c2159b378afb28d4d1f5f1e541376', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
180 'e1509d8bf5ad644ed6eb5eb8cde1c5962ed8a3c18142ee753d24b185705facff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
181 'e1a4513ed83d89a26bd5216b871b8bfda892e5cce47f539a0c04f36e93cc0077', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
182 'e2dd8628371377d56c761817ed6676c5ccd2e9870f1b8cb7b63467f0d387d8fd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
183 'e7c699fb15764decb4193d06537fd56d2ebb7e6af19919dd9b489815c200ea2c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
184 'e8a9768b0450f6383b427808fa6855e617e0f2210cfad339879a25f194aca25d', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
185 'eb1e5843a298cfb84f6b443ee59e3e5385a9d047dccb2e2d568e71b8688d74a5', // Observed malicious sender
186 'eb6fdf648b34efa0d7eed5ac971d12d2fbc5d8f8fa3c5d3abe7d307b3f1367f2', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
187 'ed227a85dd447f006e6c34ffe955bfbfd864b88e0ef91ddfc1c7f5546bdf6f90', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
188 'eeb6b71f9c3090dedbd6018df4edeb5d4c86f4819ab0223654ad44c32bac3503', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
189 'f0d099bfdabc2c0ac8f8561a64d66e9e6ee1207fc560db8fe07771fbfa4bdd52', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
190 'f12e13befd897b6b9ea41f1b299200fd71fb5137d6c0866f5af0984ac91a30cf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
191 'f31d0f49475966eea47015c6ef2888a2d8805eef2df40805808ded010183f170', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
192 'f4116dde162ca98aeabba276d40e2d7306b4a63332b67dc994bf9278452a2c60', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
193 'f47441d1d8080fd855a7ebc8ba3549958929f7d2acc70417438319bab03531bf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
194 'fa0038a882392e5496003d074ba4f627b377efe20e2cbe8aad9b8547b9222771', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
195 'fa8ac775c0747999f0733c1197e1540b5db9e456a36014347c880b03a3b2aada', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
196 'fe218207660e4c9570cea198ab32c90af1e8ea7449f188b9f3683246a1808ca3', // Observed malicious sender
197 'fff3c2530f6cc63385b2de940cc3e2c471561a3e5c28f77c650f203f1e86d6f0' // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
198 )
199
200attack_types:
201 - "BEC/Fraud"
202 - "Credential Phishing"
203 - "Malware/Ransomware"
204tactics_and_techniques:
205 - "Impersonation: Email address"
206 - "Social engineering"
207detection_methods:
208 - "Sender analysis"
209 - "Header analysis"
210id: "b1c2d3e4-f5a6-4b8c-9d0e-f1a2b3c4d5e6"