Medium Severity

Body: CSS clamp() font obfuscation with suspicious URL

Labels

Credential Phishing

Evasion

Description

Detects inbound messages where the HTML body, or an embedded .eml attachment, contains CSS using the clamp() function with a negative or zero font-size/line-height value—a technique used to hide or obscure text from readers or automated scanners—combined with a link whose URL contains an IP address or an embedded username, both common indicators of an obfuscated or malicious destination.

References

No references.

Sublime Security

Created Jul 29th, 2026 • Last updated Aug 26th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and (
  (
    regex.icontains(body.html.raw,
                    '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
    )
    and any(body.links,
            .href_url.ip.ip is not null or .href_url.username is not null
    )
  )
  or any(attachments,
         (.content_type == "message/rfc822" or .file_extension =~ "eml")
         and regex.icontains(file.parse_eml(.).body.html.raw,
                             '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
         )
         and any(file.parse_eml(.).body.links,
                 .href_url.ip.ip is not null or .href_url.username is not null
         )
  )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.