From 2cf3c874bbbc3d1da832d4e438151c8d95ca82a1 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 9 Sep 2026 00:39:13 +0000 Subject: [PATCH 1/4] chore: Update IOC rule - Spamhaus: Mail transiting an ASN-DROP listed network --- ...malicious_headers_ips_spamhaus_asndrop.yml | 131 +++++++++++++++++- 1 file changed, 126 insertions(+), 5 deletions(-) diff --git a/detection-rules/observed_malicious_headers_ips_spamhaus_asndrop.yml b/detection-rules/observed_malicious_headers_ips_spamhaus_asndrop.yml index ecb0649b009..97f39580a54 100644 --- a/detection-rules/observed_malicious_headers_ips_spamhaus_asndrop.yml +++ b/detection-rules/observed_malicious_headers_ips_spamhaus_asndrop.yml @@ -24,6 +24,15 @@ source: | // using the beta feature in custom rules is not suggested until it has been formally released // beta.ip_in(.ip, + "1.32.205.0/24", // AS152194 + "1.32.216.0/24", // AS152194 + "1.32.218.0/24", // AS152194 + "1.32.228.0/23", // AS152194 + "1.32.237.0/24", // AS152194 + "1.32.246.0/23", // AS152194 + "1.32.248.0/23", // AS152194 + "1.32.250.0/24", // AS152194 + "1.32.252.0/22", // AS152194 "2.26.8.0/22", // AS207957 "2.26.18.0/23", // AS216127 "2.26.31.0/24", // AS216127 @@ -113,6 +122,12 @@ source: | "8.242.22.0/24", // AS138915 "13.143.137.0/24", // AS207957 "14.1.96.0/22", // AS55933 + "14.128.32.0/20", // AS152194 + "14.128.48.0/21", // AS152194 + "14.128.57.0/24", // AS152194 + "14.128.58.0/23", // AS152194 + "14.128.60.0/24", // AS152194 + "14.128.63.0/24", // AS152194 "23.26.101.0/24", // AS5065 "23.26.107.0/24", // AS197450 "23.26.113.0/24", // AS5065 @@ -203,8 +218,27 @@ source: | "23.230.244.0/24", // AS44559 "24.233.0.0/19", // AS55933 "27.0.132.0/22", // AS58854 + "27.50.54.0/23", // AS152194 + "27.50.57.0/24", // AS152194 + "27.50.58.0/23", // AS152194 + "27.50.60.0/24", // AS152194 + "27.50.62.0/23", // AS152194 "27.122.32.0/20", // AS208525 "27.123.208.0/22", // AS132827 + "27.124.2.0/23", // AS152194 + "27.124.4.0/22", // AS152194 + "27.124.9.0/24", // AS152194 + "27.124.10.0/23", // AS152194 + "27.124.12.0/24", // AS152194 + "27.124.17.0/24", // AS152194 + "27.124.18.0/24", // AS152194 + "27.124.20.0/22", // AS152194 + "27.124.24.0/21", // AS152194 + "27.124.32.0/23", // AS152194 + "27.124.34.0/24", // AS152194 + "27.124.36.0/22", // AS152194 + "27.124.40.0/21", // AS152194 + "27.124.62.0/23", // AS152194 "31.6.50.0/23", // AS213200, AS399073 "31.40.196.0/24", // AS51722 "31.40.201.0/24", // AS51396 @@ -308,6 +342,7 @@ source: | "31.222.235.0/24", // AS202302 "31.222.248.0/24", // AS44559 "31.222.250.0/24", // AS62563 + "36.50.221.0/24", // AS152194 "36.255.97.0/24", // AS205759 "37.46.16.0/22", // AS210546 "37.60.141.0/24", // AS213438 @@ -431,13 +466,22 @@ source: | "43.152.163.0/24", // AS138915 "43.224.20.0/24", // AS138915 "43.224.248.0/23", // AS24544 + "43.226.16.0/24", // AS152194 + "43.226.20.0/23", // AS152194 + "43.226.23.0/24", // AS152194 + "43.226.124.0/22", // AS152194 "43.228.157.0/24", // AS205759 "43.229.240.0/22", // AS132827 "43.230.52.0/23", // AS5065 "43.231.223.0/24", // AS132827 "43.239.106.0/23", // AS5065 "43.240.12.0/22", // AS133731, AS134176 + "43.240.36.0/22", // AS152194 "43.242.200.0/22", // AS401696, AS401701 + "43.243.29.0/24", // AS152194 + "43.243.30.0/23", // AS152194 + "43.243.70.0/23", // AS152194 + "43.243.72.0/22", // AS152194 "43.243.168.0/22", // AS134176, AS55933 "43.246.198.0/24", // AS39600 "43.247.68.0/22", // AS134196 @@ -502,6 +546,7 @@ source: | "45.39.175.0/24", // AS44559 "45.39.194.0/24", // AS44559 "45.39.244.0/24", // AS44559 + "45.64.52.0/22", // AS152194 "45.64.74.0/23", // AS55933 "45.64.112.0/23", // AS55933 "45.66.164.0/24", // AS63023 @@ -1623,6 +1668,8 @@ source: | "102.217.236.0/22", // AS138915 "102.220.88.0/22", // AS55933 "102.220.160.0/22", // AS197769 + "103.1.40.0/24", // AS152194 + "103.1.42.0/23", // AS152194 "103.3.16.0/23", // AS132827 "103.3.19.0/24", // AS132827 "103.3.212.0/23", // AS38149 @@ -1639,6 +1686,8 @@ source: | "103.11.238.0/23", // AS132827, AS142622 "103.12.53.0/24", // AS142622 "103.12.54.0/24", // AS142622 + "103.12.148.0/23", // AS152194 + "103.12.151.0/24", // AS152194 "103.13.16.0/24", // AS5065 "103.13.18.0/23", // AS142622, AS39600 "103.13.45.0/24", // AS132827 @@ -1652,6 +1701,7 @@ source: | "103.18.182.0/23", // AS25862 "103.18.228.0/22", // AS39600, AS5065 "103.19.50.0/23", // AS62864 + "103.19.188.0/22", // AS152194 "103.20.158.0/24", // AS132827 "103.21.136.0/23", // AS55933 "103.21.139.0/24", // AS46370 @@ -1676,18 +1726,24 @@ source: | "103.38.254.0/24", // AS134176 "103.39.108.0/22", // AS133731 "103.40.8.0/22", // AS54801 + "103.41.64.0/22", // AS152194 "103.42.6.0/23", // AS140869 "103.42.100.0/22", // AS132827 "103.43.8.0/22", // AS401701 "103.43.50.0/23", // AS138915 "103.43.87.0/24", // AS142002 "103.44.128.0/22", // AS132827 + "103.45.64.0/22", // AS152194 + "103.45.68.0/23", // AS152194 + "103.45.70.0/24", // AS152194 "103.47.216.0/22", // AS133692 "103.51.144.0/22", // AS133731, AS134176 "103.52.152.0/22", // AS401701 "103.56.112.0/22", // AS55933 "103.59.100.0/22", // AS55933 "103.66.92.0/22", // AS55933 + "103.71.48.0/24", // AS152194 + "103.71.50.0/23", // AS152194 "103.72.200.0/24", // AS141333 "103.73.160.0/22", // AS401696, AS401701 "103.73.188.0/22", // AS135752 @@ -1743,6 +1799,7 @@ source: | "103.136.248.0/22", // AS138915 "103.137.212.0/22", // AS138968 "103.138.4.0/23", // AS133692 + "103.138.148.0/23", // AS152194 "103.140.126.0/23", // AS55933 "103.141.0.0/23", // AS140869 "103.142.102.0/23", // AS55933 @@ -1823,7 +1880,10 @@ source: | "103.229.60.0/22", // AS55933 "103.229.119.0/24", // AS55933 "103.229.124.0/22", // AS24544, AS55933 + "103.230.240.0/22", // AS152194 "103.231.12.0/22", // AS133731 + "103.231.28.0/23", // AS152194 + "103.231.30.0/24", // AS152194 "103.231.75.0/24", // AS209847 "103.233.252.0/22", // AS401696, AS401701 "103.236.224.0/23", // AS134176 @@ -1831,6 +1891,8 @@ source: | "103.237.92.0/23", // AS55933 "103.238.224.0/22", // AS55933 "103.239.0.0/22", // AS48589 + "103.241.73.0/24", // AS152194 + "103.241.74.0/24", // AS152194 "103.242.2.0/23", // AS55933 "103.242.12.0/22", // AS401696, AS401701 "103.242.132.0/22", // AS55933 @@ -1846,6 +1908,7 @@ source: | "103.248.150.0/23", // AS5065 "103.249.72.0/22", // AS132827 "103.253.142.0/23", // AS55933 + "103.254.108.0/22", // AS152194 "104.164.27.0/24", // AS213035 "104.164.28.0/24", // AS213035 "104.164.32.0/24", // AS44559 @@ -1953,6 +2016,7 @@ source: | "112.143.32.0/20", // AS208525, AS215731 "112.196.195.0/24", // AS5065 "112.196.206.0/23", // AS5065 + "112.213.96.0/19", // AS152194 "113.203.209.0/24", // AS34450 "113.203.219.0/24", // AS34450 "113.213.128.0/20", // AS208525 @@ -1961,8 +2025,23 @@ source: | "114.200.46.0/23", // AS138915 "116.204.132.0/22", // AS401701 "116.206.94.0/23", // AS138968 + "117.18.0.0/23", // AS152194 + "117.18.5.0/24", // AS152194 + "117.18.7.0/24", // AS152194 + "117.18.13.0/24", // AS152194 + "117.18.15.0/24", // AS152194 "117.120.220.0/22", // AS140869 + "118.107.0.0/21", // AS152194 + "118.107.9.0/24", // AS152194 + "118.107.10.0/23", // AS152194 + "118.107.12.0/22", // AS152194 + "118.107.16.0/20", // AS152194 + "118.107.32.0/20", // AS152194 + "118.107.48.0/24", // AS152194 + "118.107.56.0/21", // AS152194 "119.46.51.0/24", // AS138915 + "121.54.168.0/21", // AS152194 + "121.127.224.0/19", // AS152194 "122.8.44.0/22", // AS59651 "122.8.92.0/22", // AS59651 "122.10.101.0/24", // AS134196 @@ -2034,6 +2113,7 @@ source: | "132.243.223.0/24", // AS213702 "132.243.225.0/24", // AS213702 "132.243.231.0/24", // AS213702 + "134.122.128.0/17", // AS152194 "134.168.228.0/24", // AS142002 "134.168.240.0/22", // AS142002 "134.168.244.0/24", // AS142002 @@ -2121,6 +2201,7 @@ source: | "136.234.248.0/24", // AS44559 "136.234.251.0/24", // AS44559 "136.234.254.0/24", // AS44559 + "137.220.128.0/17", // AS152194 "138.0.121.0/24", // AS63023 "138.16.0.0/20", // AS44559 "138.16.16.0/24", // AS44559 @@ -2174,7 +2255,6 @@ source: | "138.124.127.0/24", // AS210644 "138.124.228.0/23", // AS216127 "138.124.230.0/24", // AS216127 - "138.226.236.0/23", // AS205775 "138.226.239.0/24", // AS213474 "138.249.37.0/24", // AS44559 "138.249.56.0/24", // AS44559 @@ -2280,6 +2360,11 @@ source: | "143.20.133.0/24", // AS5065 "143.20.158.0/23", // AS5065 "143.20.163.0/24", // AS5065 + "143.92.32.0/21", // AS152194 + "143.92.40.0/24", // AS152194 + "143.92.42.0/23", // AS152194 + "143.92.44.0/22", // AS152194 + "143.92.48.0/20", // AS152194 "143.109.37.0/24", // AS140869 "144.31.0.0/21", // AS215730 "144.31.11.0/24", // AS215730 @@ -2659,7 +2744,6 @@ source: | "154.214.36.0/22", // AS54801 "154.214.40.0/21", // AS54801 "154.214.48.0/21", // AS54801 - "154.214.198.0/24", // AS47890 "154.214.205.0/24", // AS47890 "154.214.213.0/24", // AS47890 "154.218.0.0/24", // AS54801 @@ -2928,6 +3012,7 @@ source: | "163.5.163.0/24", // AS5065 "163.5.220.0/24", // AS399073 "163.123.140.0/24", // AS213035 + "164.138.0.0/22", // AS213753 "164.155.2.0/24", // AS62864 "164.155.6.0/24", // AS62864 "164.155.28.0/22", // AS62864 @@ -3226,6 +3311,7 @@ source: | "185.43.251.0/24", // AS62206 "185.46.84.0/22", // AS35624 "185.46.175.0/24", // AS44559 + "185.47.141.0/24", // AS211066 "185.49.173.0/24", // AS215117 "185.56.81.0/24", // AS211720 "185.56.83.0/24", // AS211720 @@ -3347,7 +3433,6 @@ source: | "185.230.143.0/24", // AS210644 "185.230.230.0/23", // AS62563, AS63023 "185.231.32.0/23", // AS211720 - "185.231.205.0/24", // AS209847 "185.231.206.0/24", // AS209847 "185.232.64.0/23", // AS42397, AS47890 "185.232.66.0/24", // AS47890 @@ -3496,6 +3581,7 @@ source: | "192.102.254.0/23", // AS62563 "192.109.138.0/24", // AS213438 "192.109.200.0/24", // AS197170 + "192.128.69.0/24", // AS211066 "192.159.99.0/24", // AS210558 "192.162.199.0/24", // AS214351 "192.166.224.0/23", // AS63023 @@ -3507,6 +3593,8 @@ source: | "192.210.252.0/24", // AS63023 "192.228.124.0/23", // AS134176 "192.249.89.0/24", // AS134196 + "192.252.176.0/20", // AS152194 + "192.253.224.0/20", // AS152194 "192.253.243.0/24", // AS208185 "192.253.248.0/24", // AS213790 "192.253.254.0/24", // AS208185 @@ -3611,7 +3699,6 @@ source: | "194.0.221.0/24", // AS41155 "194.0.223.0/24", // AS41155 "194.1.200.0/24", // AS41155 - "194.4.49.0/24", // AS209847 "194.5.65.0/24", // AS400992 "194.9.208.0/22", // AS207986 "194.11.246.0/24", // AS215117 @@ -3769,9 +3856,34 @@ source: | "201.7.17.0/24", // AS63023 "201.7.20.0/23", // AS197450 "202.0.127.0/24", // AS17612 + "202.36.51.0/24", // AS152194 + "202.36.54.0/24", // AS152194 + "202.36.56.0/23", // AS152194 + "202.36.61.0/24", // AS152194 + "202.61.128.0/19", // AS152194 + "202.61.160.0/24", // AS152194 + "202.61.164.0/22", // AS152194 + "202.61.168.0/21", // AS152194 + "202.61.176.0/20", // AS152194 + "202.79.162.0/23", // AS152194 + "202.79.164.0/22", // AS152194 + "202.79.168.0/21", // AS152194 + "202.95.1.0/24", // AS152194 + "202.95.5.0/24", // AS152194 + "202.95.6.0/23", // AS152194 + "202.95.8.0/21", // AS152194 + "202.95.16.0/21", // AS152194 "202.126.110.0/23", // AS5065 "202.134.229.0/24", // AS5065 + "202.146.216.0/21", // AS152194 "202.155.134.0/23", // AS5065 + "202.162.96.0/24", // AS152194 + "202.162.98.0/23", // AS152194 + "202.162.100.0/23", // AS152194 + "202.162.103.0/24", // AS152194 + "202.162.104.0/23", // AS152194 + "202.162.106.0/24", // AS152194 + "202.162.109.0/24", // AS152194 "202.181.24.0/22", // AS134196, AS55933 "203.98.68.0/24", // AS215117 "203.132.96.0/22", // AS208525 @@ -3827,7 +3939,6 @@ source: | "207.60.0.0/18", // AS54801 "207.70.192.0/21", // AS208525 "207.70.224.0/20", // AS208525 - "207.89.18.0/24", // AS205775 "207.97.128.0/21", // AS5065 "207.97.142.0/24", // AS5065 "207.97.145.0/24", // AS5065 @@ -3887,6 +3998,7 @@ source: | "209.213.192.0/22", // AS5065 "209.213.200.0/22", // AS5065 "209.213.216.0/23", // AS5065 + "210.56.48.0/20", // AS152194 "210.79.180.0/24", // AS152149 "210.211.24.0/22", // AS215731, AS25862 "211.60.106.0/24", // AS138915 @@ -4085,6 +4197,12 @@ source: | "220.158.205.0/24", // AS46370 "222.167.226.0/24", // AS63023 "222.167.230.0/24", // AS63023 + "223.26.48.0/24", // AS152194 + "223.26.52.0/24", // AS152194 + "223.26.57.0/24", // AS152194 + "223.26.59.0/24", // AS152194 + "223.26.61.0/24", // AS152194 + "223.26.62.0/23", // AS152194 "223.29.136.0/22", // AS5065 "2001:470:491::/48", // AS18526 "2001:470:526::/48", // AS5065 @@ -4126,6 +4244,7 @@ source: | "2403:3a40::/32", // AS55933 "2403:3b40::/32", // AS55933 "2403:3bc0::/32", // AS55933 + "2403:ea00::/32", // AS152194 "2404:3bc0::/32", // AS55933 "2404:3c40::/32", // AS55933 "2404:7c40::/32", // AS134196 @@ -4161,6 +4280,7 @@ source: | "2405:7240::/32", // AS55933 "2406:99c0::/32", // AS133692 "2407:2f40::/48", // AS140787 + "2407:7580::/32", // AS152194 "2407:7d00:1::/48", // AS58854 "240d:c010:102::/48", // AS138915 "2602:f6a0::/40", // AS134176 @@ -4523,6 +4643,7 @@ source: | "2a14:c380:26::/48", // AS200912 "2a14:c380:31::/48", // AS216078 "2a14:c380:32::/47", // AS216078 + "2a14:c380:1100::/40", // AS203861 "2a14:c380:3000::/40", // AS216078 "2a14:c380:4000::/40", // AS216078 "2a14:dc81:2000::/36", // AS62563 From 96116d34cd278d26777f734b020f4e2312808218 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 9 Sep 2026 14:14:41 +0000 Subject: [PATCH 2/4] chore: Update IOC rule - Spamhaus: Mail transiting an ASN-DROP listed network --- ...served_malicious_headers_ips_spamhaus_asndrop.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/detection-rules/observed_malicious_headers_ips_spamhaus_asndrop.yml b/detection-rules/observed_malicious_headers_ips_spamhaus_asndrop.yml index 97f39580a54..0e16d4a14a7 100644 --- a/detection-rules/observed_malicious_headers_ips_spamhaus_asndrop.yml +++ b/detection-rules/observed_malicious_headers_ips_spamhaus_asndrop.yml @@ -6,7 +6,7 @@ references: type: "rule" severity: "medium" source: | - // Spamhaus DROP List 2026/09/08 - (c) 2026 The Spamhaus Project SLU + // Spamhaus DROP List 2026/09/09 - (c) 2026 The Spamhaus Project SLU // Source: https://www.spamhaus.org/drop/asndrop.json Terms: https://www.spamhaus.org/drop/terms/ type.inbound // False positives are possible as benign mail can transit a host on the Spamhaus DROP list. Sender domain exclusions @@ -318,6 +318,7 @@ source: | "31.77.7.0/24", // AS207957 "31.77.56.0/23", // AS213702 "31.77.106.0/24", // AS215730 + "31.77.113.0/24", // AS215730 "31.77.138.0/24", // AS213702 "31.77.140.0/22", // AS207957 "31.77.168.0/24", // AS213702 @@ -518,7 +519,7 @@ source: | "45.11.175.0/24", // AS399073 "45.12.114.0/24", // AS33993 "45.12.134.0/23", // AS209847 - "45.12.143.0/24", // AS209847 + "45.12.143.0/24", // AS209847, AS51722 "45.12.146.0/24", // AS209847 "45.12.151.0/24", // AS209847 "45.13.37.0/24", // AS47890 @@ -1563,7 +1564,7 @@ source: | "94.131.113.0/24", // AS33993 "94.131.118.0/24", // AS209847 "94.131.121.0/24", // AS33993 - "94.131.123.0/24", // AS209847 + "94.131.123.0/24", // AS209847, AS51722 "94.131.210.0/23", // AS43743 "94.154.35.0/24", // AS202412 "94.154.39.0/24", // AS57100 @@ -1884,7 +1885,7 @@ source: | "103.231.12.0/22", // AS133731 "103.231.28.0/23", // AS152194 "103.231.30.0/24", // AS152194 - "103.231.75.0/24", // AS209847 + "103.231.75.0/24", // AS209847, AS51722 "103.233.252.0/22", // AS401696, AS401701 "103.236.224.0/23", // AS134176 "103.236.252.0/22", // AS58854 @@ -2164,7 +2165,7 @@ source: | "135.106.126.0/24", // AS44559 "136.175.56.0/23", // AS3507 "136.176.64.0/21", // AS63023 - "136.176.72.0/24", // AS63023 + "136.176.72.0/23", // AS63023 "136.234.128.0/24", // AS44559 "136.234.132.0/24", // AS44559 "136.234.135.0/24", // AS44559 @@ -2445,6 +2446,7 @@ source: | "148.178.32.0/19", // AS54801 "148.178.64.0/18", // AS54801 "148.178.128.0/17", // AS54801 + "148.222.158.0/24", // AS5065 "149.3.170.0/24", // AS213373 "149.7.16.0/24", // AS63023 "149.19.197.0/24", // AS18526 From faa5492371f7c740a99fac40858db21969ae63ac Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 9 Sep 2026 14:14:41 +0000 Subject: [PATCH 3/4] chore: Update IOC rule - Spamhaus: Mail transiting a DROP listed network --- .../observed_malicious_headers_ips_spamhaus_drop.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detection-rules/observed_malicious_headers_ips_spamhaus_drop.yml b/detection-rules/observed_malicious_headers_ips_spamhaus_drop.yml index a1caf766cbd..7fe2006ef28 100644 --- a/detection-rules/observed_malicious_headers_ips_spamhaus_drop.yml +++ b/detection-rules/observed_malicious_headers_ips_spamhaus_drop.yml @@ -7,7 +7,7 @@ references: type: "rule" severity: "medium" source: | - // Spamhaus DROP List 2026/09/08 - (c) 2026 The Spamhaus Project SLU + // Spamhaus DROP List 2026/09/09 - (c) 2026 The Spamhaus Project SLU // Source: https://www.spamhaus.org/drop/drop_v4.json Terms: https://www.spamhaus.org/drop/terms/ type.inbound // False positives are possible as benign mail can transit a host on the Spamhaus DROP list. Sender domain exclusions @@ -679,6 +679,7 @@ source: | "142.102.0.0/16", // SBL307428 "143.92.32.0/19", // SBL612606, SBL654967, SBL664725 "143.222.0.0/16", // SBL691991 + "144.172.65.0/24", // SBL699979 "144.215.0.0/16", // SBL641808 "145.231.0.0/16", // SBL268204 "146.3.0.0/16", // SBL220725 From 03c45c546c15e0391e5f435a4c82f740780ea290 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 9 Sep 2026 14:14:41 +0000 Subject: [PATCH 4/4] chore: Update IOC rule - Observed IOC: Malicious sender email addresses --- detection-rules/observed_malicious_sender_emails.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/detection-rules/observed_malicious_sender_emails.yml b/detection-rules/observed_malicious_sender_emails.yml index c3240f95976..1ef30b6f757 100644 --- a/detection-rules/observed_malicious_sender_emails.yml +++ b/detection-rules/observed_malicious_sender_emails.yml @@ -11,6 +11,7 @@ source: | '0025925158ebaf2924dc24ff2d2c31c8613e2023b5bae2101cb1e752ff187eba', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads '00d63ceac2fd6e0420e5b39810077268b95dc4f4596d6185fdd68a634acfa1e0', // Attacker-registered domain - BEC reconnaissance campaigns '03f4447e4e825556bd7f47093b610e80f7962b0dfa62027b8e5f4315d7856d62', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads + '04dccb790fc71da69d21ff741dc56881f76c5f04714da607df676756ce93d82b', // Compromised Russian domain - USPS survey reward phishing hosted on Google Cloud Storage '054a555253046cedcbcec7ef343b0b7e3ad923a016c08c45e9346dba1bd30726', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads '057761a14911145dd930fac2ae3362ee5478bda82cfe87ea89aacd86a95cd6af', // Observed malicious sender - compromised SendGrid tenant, fake Teams invite credphish '05ade64fe819dabde607772648db630b90b1831b31ddbd932b17e0559d59c00e', // Observed malicious sender @@ -70,6 +71,7 @@ source: | '3a11180346d6de0d66d38dfe9482b0fd998183d30f10d02940d1caf458457d16', // Compromised account - Polish school domain used in BEC campaigns '3abf8f34e546677fd2a4ec081bcd6ec11d80fcadd49e83b342a9aec6fb723231', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads '3c6d0480a53df3b3c3e2c27a210d99d9704e02814e1d11507e02490695eb8806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads + '40742af9c50cbbdd54fda2fedaf88429d78e34f6df5cc0b34fe7851b354472cb', // Attacker registered domain - fake billing review credential phishing '416423ad3b195a68f1f8cea67899e4eaf97428c128e2ae30c3fa607f8951c0d6', // Compromised account - Vietnamese university domain used in BEC campaigns '4218528d5686b4329c1e288e27482db00b4f97b4051e5422cc9df53e89242497', // Compromised Portuguese business account - fake photo share credphish campaigns '4249dea393334f7526450a59092d3ae3c2b57ce5473ac8c43700a1811b24b79a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads @@ -141,6 +143,7 @@ source: | '89f1d71e971311f8d39a86a1bffa3b8c66f9e4c6569050af6424ae77d45242ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads '8a47d2234827f5ded1d6bc235b16bf78b6f993c5799b4145888de15ba9a5e741', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads '8ccd1976165c5acf2be6d44e89c95808574b584a2289354059554ba92f3ee355', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads + '8d0a6552bc32f3704106dcbdd393c73ceb29a4bbfd7f0ec207ea438c757b608e', // Compromised Vietnamese bank account - advance fee fraud gift and prize campaigns '8e54f90fa7e47835cbb71d612b21b611fae8646c152b17041c5834d331cc4fed', // Observed malicious sender '8f70301abb6faa9b1b0463bda1a42a153a49c849dae45c24ca087b49cbd6f16f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads '904e10d30ea2b3ba2f2a8b79645b18998e47d13258a03577242d65b3367fbd10', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads @@ -151,6 +154,7 @@ source: | '949999f91a3feac5a7b82ce881d1a32f8aea674ff928f5a7f8950076033272d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads '94a586de7ec274964f27506d5f27a6d717a1d472306017737ea067830889fb98', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads '95f01da32fea6a5c28b5453568b7d3977a76e3ae42e7375534f22cd5c43c089a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads + '99563d51af8f00be8f300763fd1a9dd2a1b38bf4d7d5d1fa370384a1f914f712', // Compromised account - German language inheritance advance fee fraud impersonating Bank of England '99673797051adaeb68dc8b07624ba300472cf9cff1a995fa1f95d8b6685374dc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads '9b3afc720c7975523f572be5e2b8e75a2567257a834e73ba3c11eeae4c53467b', // Attacker domain - fake eForm/spreadsheet sharing via SendGrid abuse '9b4bc1752d36bb4718a2a30342761e8ccecb5d64dc9164c3127dab30614811d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads @@ -219,6 +223,7 @@ source: | 'e4e85ae5800109afd8bf3d353b16206f3b68cb92447172ca88c317e62a6634a2', // Compromised account - used in Google Calendar invite fake voicemail credential phishing campaigns 'e7c699fb15764decb4193d06537fd56d2ebb7e6af19919dd9b489815c200ea2c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads 'e8a9768b0450f6383b427808fa6855e617e0f2210cfad339879a25f194aca25d', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads + 'ea32f0fb78dd6c1355f2060946aa7ca21d23e7d21c2e726c0077427afe01f25a', // Compromised Turkish manufacturer service account - thread hijacking with credential phishing redirect 'eb6fdf648b34efa0d7eed5ac971d12d2fbc5d8f8fa3c5d3abe7d307b3f1367f2', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads 'ed227a85dd447f006e6c34ffe955bfbfd864b88e0ef91ddfc1c7f5546bdf6f90', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads 'eeb6b71f9c3090dedbd6018df4edeb5d4c86f4819ab0223654ad44c32bac3503', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads @@ -228,6 +233,7 @@ source: | 'f4116dde162ca98aeabba276d40e2d7306b4a63332b67dc994bf9278452a2c60', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads 'f47441d1d8080fd855a7ebc8ba3549958929f7d2acc70417438319bab03531bf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads 'f4db533881dd346485a0167dc80828daa28a8c2079f513041c813da3545c68a8', // Observed malicious sender + 'f693fc266ddb82491f9b4fd1cfbb727fe8a76713a9f70095dd9ff8452416ab62', // Compromised Puerto Rico nonprofit account - image-based legal subpoena lure targeting accounts payable 'f994c522d9fc5386e1632cff88140e6159efc67021460d7bb798fcf16a396767', // Observed malicious sender 'fa0038a882392e5496003d074ba4f627b377efe20e2cbe8aad9b8547b9222771', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads 'fa8ac775c0747999f0733c1197e1540b5db9e456a36014347c880b03a3b2aada', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads