Medium Severity

Brand impersonation: Anthropic/Claude with newly registered domain

Labels

BEC/Fraud

Spam

Description

Detects messages impersonating Anthropic or Claude using sender display names of 'Anthropic' or 'Claude' from domains not affiliated with the legitimate brands. The rule flags messages where the sending domain, reply-to domain, or return-path domain is newly registered (under 90 days old).

References

No references.

Sublime Security

Created Jul 24th, 2026 • Last updated Jul 24th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and regex.icontains(sender.display_name, '(?:claude|anthropic)')
// sender display name with claude, anthropic - created less than 90 days
and network.whois(sender.email.domain).days_old <= 90

// common theme for suspicious claude, anthropic
and 2 of (
  strings.icontains(body.current_thread.text, "ad account"),
  strings.icontains(body.current_thread.text, "claude ads"),
  strings.icontains(body.current_thread.text, "trial access"),
  strings.icontains(body.current_thread.text, "subscription"),
  strings.icontains(body.current_thread.text, "workspace"),
  strings.icontains(body.current_thread.text, 'ads team'),
  strings.icontains(body.current_thread.text, 'google ads'),
  regex.icontains(body.current_thread.text, "connect.{0,30}account"),
  regex.icontains(body.current_thread.text, '\banthropic\s+(?:team|pbc)\b'),
  2 of (
    strings.icontains(body.current_thread.text, '548 Market Street'),
    strings.icontains(body.current_thread.text, 'San Francisco'),
    strings.icontains(body.current_thread.text, 'CA 94104')
  ),
  any(ml.nlu_classifier(body.current_thread.text).entities,
      .name == "sender"
      and strings.icontains(.text, "Claude", "Anthropic")
      and strings.iends_with(.text, "Team")
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.