High Severity

Link: Observed URL pattern with specific domain registrar

Labels

Description

Detects messages using Element Email service infrastructure, identified by characteristic URL patterns with /f/ paths, unsubscribe links, single domain usage, and Cloudflare domain registration. This pattern indicates potential abuse of legitimate email marketing services.

References

No references.

Sublime Security

Created Jun 12th, 2026 • Last updated Jun 12th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
// Signs of Email Element use
// all links are the same domain
and length(distinct(body.current_thread.links, .href_url.domain.root_domain)) == 1
// all links contain the /f/
and all(body.current_thread.links,
        regex.icontains(.href_url.path, '^/(?:unsubscribe/)?f/')
)
// there is an unsub link
and length(filter(body.current_thread.links,
                  strings.icontains(.href_url.path, '/unsubscribe/f/')
           )
) == 1
// this actor uses CF for domain management
and network.whois(sender.email.domain).registrar_name == "Cloudflare, Inc."

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.