Sublime Security high experimental mql

Hardbacon infrastructure abuse

Hardbacon is a defunct Canadian budgeting app. Attackers have been observed using their marketing platform to send credential phishing messages.

View Source

Detection Logic

type.inbound
and sender.email.domain.root_domain in ('hardbacon.com', 'hardbacon.ca')
and headers.mailer == 'Sendinblue'
and headers.auth_summary.dmarc.pass
and headers.auth_summary.spf.pass

Field Validations

Loading…

Comments (0)

Loading comments...