Medium Severity

Fraudulent order confirmation/shipping notification from Chinese sender domain

Labels

BEC/Fraud

Social engineering

Content analysis

Natural Language Understanding

Sender analysis

Whois

Description

Detects an order confirmation/shipping notification from a suspicious sender domain based in China. The order may be legitimately placed by the user, but the store is fraudulent and it is unlikely that their order will arrive. Links to these e-commerce sites have been observed in online advertising. We recommend enabling a custom warning banner to alert users and prompt them to contact their bank to recover their funds.

References

No references.

Sublime Security

Created Dec 3rd, 2025 • Last updated Dec 3rd, 2025

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
// direct to recipient
and length(recipients.to) == 1
and length(body.previous_threads) == 0

// Known patterns
and (sender.display_name is null or sender.email.local_part == "support")
and all(headers.reply_to, .email.domain.root_domain == sender.email.domain.root_domain)

// Alibaba Cloud nameservers
and length(network.whois(sender.email.domain).name_servers) > 0
and all(network.whois(sender.email.domain).name_servers,
        .root_domain == "hichina.com"
)

// Shipping notification
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in ('Shipping and Package', "Order Confirmations")
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.