Medium Severity

Reconnaissance: Fake real estate inquiry with empty body

Description

Detects inbound messages with no body content — neither plain text nor HTML — but an unusually long subject line containing real estate inquiry language. The subject lines impersonate prospective home buyers asking about specific property listings or seeking a trusted local real estate agent, often mentioning relocation. These messages are designed to establish contact with real estate professionals as a precursor to fraud.

References

No references.

Sublime Security
Created Jul 8th, 2026 • Last updated Jul 8th, 2026
Source
type.inbound
and (
  body.plain.raw is null
  or body.plain.raw == ""
  or regex.imatch(body.plain.raw, '^\s*$')
)
and (
  body.html.raw is null
  or body.html.raw == ""
  or regex.imatch(body.html.raw, '^\s*$')
)
and length(subject.base) > 150
and (
  strings.icontains(subject.base, 'purchase a home')
  or regex.icontains(subject.base,
                     'the listing (?:on|at)',
                     '(?:interested in|regarding) (?:this|the) property',
                     '(?:will be|are) relocating'
  )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started