• Sublime Core Feed
High Severity

Headers: Fake in-reply-to with wildcard sender and missing thread context

Description

Detects messages claiming to be replies with In-Reply-To headers but lacking previous thread context, sent from addresses containing multiple wildcard characters in the local part.

References

No references.

Sublime Security
Created Jan 23rd, 2026 • Last updated Jan 23rd, 2026
Source
type.inbound
and headers.in_reply_to is not null
and not (subject.is_forward or subject.is_reply)
and length(body.previous_threads) == 0
and strings.count(sender.email.local_part, "*") >= 2
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started