Medium Severity

Link: Fake Cloudflare verification landing page

Description

Detects inbound messages sent to undisclosed or empty recipient lists with no CC and a small number of embedded links, where at least one link resolves to a landing page with an empty href and loads the Cloudflare Insights beacon script.

References

No references.

Sublime Security
Created Sep 11th, 2026 • Last updated Sep 11th, 2026
Source
type.inbound
and (
  any(recipients.to, .email.domain.valid == false) or length(recipients.to) == 0
)
and length(recipients.cc) == 0
and 0 < length(distinct(body.links, .href_url.url)) < 8
and any(body.links,
        any(html.xpath(ml.link_analysis(.).final_dom, '//a').nodes,
            .display_text == "Why am I seeing this page?"
            and strings.contains(.raw, 'href="#"')
        )
        and any(ml.link_analysis(.).unique_urls_accessed,
                .domain.domain == "static.cloudflareinsights.com"
                and strings.contains(.path, "/beacon.min.js/")
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started