Sublime Security high experimental mql

Punycode sender domain

The sender's domain contains punycode, a technique used by attackers to impersonate legitimate domains.

Detection Logic

type.inbound
and strings.ilike(sender.email.domain.domain, "*xn--*")

Loading…

Loading comments...