Description

Detects inbound messages containing exactly one Squarespace tracking link but lacking authentic Squarespace email headers and sender patterns.

References

No references.

Sublime Security
Created Apr 1st, 2025 • Last updated Aug 5th, 2025
Source
type.inbound
and any(body.links, .href_url.domain.domain == "engage.squarespace-mail.com")
and length(body.links) < 10
// there is one unique Squarespace Link in the message
and length(distinct(filter(body.links,
                           .href_url.domain.domain == "engage.squarespace-mail.com"
                    ),
                    .href_url.url
           )
) == 1
and not headers.return_path.domain.root_domain == "squarespace-mail.com"
and not any(headers.domains, .root_domain == "squarespace-mail.com")
and profile.by_sender_email().prevalence != "common"
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started