Medium Severity

Link: Suspicious HTML structure with subject mirrored in body and single link

Labels

Description

Detects messages where the subject is mirrored in a styled HTML table element, while containing exactly one link. This structural pattern is indicative of templated lures designed to appear legitimate.

References

No references.

Sublime Security

Created Jul 27th, 2026 • Last updated Jul 27th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(html.xpath(body.html,
                   '//body/div//table/tbody/tr//table/tbody/tr/td[contains(@style, "rgb(41, 88, 140)")]/div/b'
        ).nodes,
        subject.base == .display_text
)
and any(html.xpath(body.html,
                   '//body/div//table/tbody/tr//table/tbody/tr/td/div[contains(@style, "margin-top: 12pt")]/div'
        ).nodes,
        strings.icontains(subject.base, .inner_text)
)
and length(html.xpath(body.html,
                      '//body/div//table/tbody/tr//table/tbody/tr/td/div[contains(@style, "margin-top: 12pt")]/div//a'
           ).nodes
) == 1

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.