• Sublime Core Feed
Medium Severity

Fake warning banner using confusable characters

Description

Detects messages containing fake security banners that use visually similar characters to impersonate legitimate sender verification text, potentially to bypass security controls and deceive recipients.

References

No references.

Sublime Security
Created Mar 2nd, 2026 • Last updated Mar 2nd, 2026
Source
type.inbound
and (
  regex.contains(strings.replace_confusables(body.current_thread.text),
                 'This sender has been verified fro(?:m|rn) safe senders list'
  )
  or any(body.current_thread.banners,
         regex.contains(strings.replace_confusables(.text),
                        'This sender has been verified fro(?:m|rn) safe senders list'
         )
  )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started