Abnormal

REPORTING

  • Dashboard

MESSAGING

  • Threat Log
  • Outbound Log
  • AI Security Mailbox
  • Vendor Fraud
  • Search & Respond
  • Detection 360°

ACCOUNT

  • Account Takeover

POSTURE

  • App Posture
  • People Posture
  • Tenant Posture

KNOWLEDGE

  • AppBase
  • PeopleBase
  • TenantBase
  • VendorBase
  • ThreatIntelBase

ENHANCE

  • Success Criteria
  • Abnormal App Store
  • Deployment Overview
  • Platform Integrations
  • Settings
Outbound Log>

Message Details

Company
User Name
Sapling Media Renewal Agreement
6 days agoJan 19, 2025, 4:35pm PST

Analysis Overview

Employee sent an email to a recipient at halogenlights.com who they rarely communicate with. Abnormal believes this email may likely be misdirected.

RECIPIENT DOMAIN MISMATCH WITH SUBJECT

The subject references "Sapling Media" which might not be intended for a recipient at halogenlights.com.

RARE RECIPIENT

The employee rarely communicates with recipients at halogenlights.com. The recipient may be unusual.

Email Content

Subject: Sapling Media Renewal Agreement
Sender: Jonathan Green <jonathan.green@enterprise.com>
To: Robin Stuart <robin.stuart@halogenlights.com>
Jan 19, 2025, 4:35pm PST
Agreement_02182025.pdf

Hi Robin,

Please find the updated renewal agreement for your review. Please go through the details and let me know if everything looks good on your end. You can highlight any revisions before we finalize.

Let me know if you have any questions. Looking forward to your response.

Best,

Jonathan

Activity log

Email Sent
Jan 19, 2025, 4:35pm PST
Flagged by Abnormal
Jan 19, 2025, 4:35pm PST

Engineering Reference Only

Heuristic Name
subject-and-attachment-client-mismatch-with-rare-recipient (Subject)
When to show
If only subject is mismatched with recipient domain
Email Notification