Medium Severity

Link: Remittance payment request with timeline template

Labels

Description

Detects messages containing references to business days and account information with links containing 'remittance' in the URL path, commonly used in financial fraud schemes. This rule is looking at a specific template we're seeing in use with a expedited timeline.

References

No references.

Sublime Security

Created Jun 4th, 2026 • Last updated Jun 4th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and strings.icontains(body.plain.raw, "business days")
and strings.icontains(body.plain.raw, "account")
and any(filter(body.links,
               .href_url.domain.root_domain not in $tranco_10k
               or (
                 .href_url.domain.root_domain in $tranco_10k
                 and (
                   .href_url.domain.domain in $self_service_creation_platform_domains
                   or .href_url.domain.root_domain in $self_service_creation_platform_domains
                   or .href_url.domain.root_domain in $free_file_hosts
                   or .href_url.domain.domain in $free_file_hosts
                 )
               )
        ),
        strings.icontains(.href_url.path, "remittance")
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.