Medium Severity

Body: CSS clamp() font obfuscation with IP-based links

Labels

Credential Phishing

Evasion

Description

Detects inbound messages using a CSS evasion technique where font-size or line-height properties are set using the clamp() function with very small or negative values — a method used to hide or manipulate rendered text and evade content-based detection. Messages matching this pattern also contain at least one hyperlink resolving directly to an IP address rather than a domain. Observed lures span a wide range of social engineering themes including urgent account alerts, financial offers, storage login codes, service cancellations, and renewal reminders.

References

No references.

Sublime Security

Created Jul 29th, 2026 • Last updated Jul 29th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and (
  (
    regex.icontains(body.html.raw,
                    '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
    )
    and any(body.links, .href_url.ip.ip is not null)
  )
  or any(attachments,
         (.content_type == "message/rfc822" or .file_extension =~ "eml")
         and regex.icontains(file.parse_eml(.).body.html.raw,
                             '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
         )
         and any(file.parse_eml(.).body.links, .href_url.ip.ip is not null)
  )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.