High Severity

Scam: Fake estate sale offering welding equipment and tools

Description

Detects fraudulent messages impersonating someone selling inherited or estate items, specifically targeting welding equipment, power tools, and machinery. These messages typically claim items are from a deceased relative's estate or due to relocation, require shipping arrangements, and use emotional manipulation to appear legitimate while requesting contact through alternative channels.

References

No references.

Sublime Security
Created May 12th, 2026 • Last updated May 12th, 2026
Source
length(body.current_thread.links) < 10
and length(body.current_thread.text) < 3000
and (
  regex.icontains(body.current_thread.text,
                  '(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)\s*[^\r\n]{0,50}(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)',
                  '(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)\s*[^\r\n]{0,50}(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)'
  )
  or regex.icontains(body.current_thread.text,
                     '(?:Caterpillar|\bCAT\b|John\s*Deere|Kubota|Bobcat|Honda|Generac|Stihl|Husqvarna|\bToro\b)\s*[^\r\n]{0,50}(?:\bgenerator\b|\bchainsaw\b|\bexcavator\b|\bskid\s*steer\b|\btractor\b|\bmower\b|\bloader\b|\bbackhoe\b)'
  )
  or regex.icontains(body.current_thread.text,
                     '(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)\s*[^\r\n]{0,50}(?:available|sale|rehome|gift|giving\s*away|free)',
                     '(?:available|sale|rehome|gift|giving\s*away|free)\s*[^\r\n]{0,50}(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)'
  )
  or strings.ilike(body.current_thread.text,
                   '*welding tools*',
                   '*tools and accessories*'
  )
  or (
    length(regex.extract(body.current_thread.text,
                         '(?i)(?:generator|refrigerator|trailer|tractor|lawnmower|mower|washer|dryer|freezer|treadmill|peloton|vanity|dresser|couch|sectional|kennel|mattress|bed\s*frame|hot\s*tub|golf\s*cart|tv|gazebo|loveseat|dishwasher|microwave|kitchenaid|rolex|watch|honda|toyota|ford|chevy|jeep|kubota|bobcat|polaris|kawasaki|macbook|iphone|playstation|ps5|xbox|canon|sony|dji|piano|keyboard|guitar|violin)\b[^\r\n]{0,30}(?:\(\s*\d{2,5}\s*\)|\$\s*\d{2,5}|\bfor\s+\$?\d{2,5})'
           )
    ) >= 5
    and regex.icontains(body.current_thread.text,
                        'late (?:husband|father|dad|wife|mother|mom)',
                        '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate'
    )
  )
)
and (
  regex.icontains(body.current_thread.text,
                  'late (?:husband|father|dad|wife|mother|mom)',
                  '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate',
                  'inherited instruments',
                  'just lost (?:her|his|their) (?:husband|father|dad|wife|mother|mom)'
  )
  or strings.ilike(body.current_thread.text,
                   '* downsizing *',
                   '* relocating soon *',
                   '* to relocate *',
                   '*prepares to relocate*',
                   '*relocate with*family*'
  )
  or strings.ilike(body.current_thread.text,
                   '*sponsored*giveaway*',
                   '*giveaway*sponsored*',
                   '* generously offering *',
                   '* generous offer *',
                   '*a loving home*',
                   '*a good home*',
                   '*find a new home *',
                   '*rehome these instruments *',
                   '* free donation*'
  )
  or regex.icontains(body.current_thread.text,
                     'giv\w+\s+away\s+(?:her|his|their|my|our)\s+(?:late|deceased|dad|father|mother|husband|wife)',
                     'giv\w+\s+away\s+(?:her|his|their|my|our)[^\r\n]{0,40}(?:tool|welder|welding|equipment|instrument|machine)'
  )
  or strings.ilike(body.current_thread.text,
                   '*generous opportunity*',
                   '*who needs a reliable*',
                   '*comprehensive set of tools*',
                   '*top-of-the-line machine*'
  )
)
and (
  regex.icontains(body.current_thread.text,
                  'shipping (?:fee|cost|arrangement)',
                  '(?:responsible|pay) for shipping',
                  'no (?:local\s)?pick.?up',
                  '(?:local\s)?pick.?up.{0,50}not available',
                  'delivery only',
                  'moving company'
  )
  or strings.ilike(body.current_thread.text,
                   '* if you will take it *',
                   '* or have someone *',
                   '* indicate your interest *',
                   '* to someone you know *',
                   '* know someone who *',
                   '* someone you know would *',
                   '* someone who will *',
                   '* someone who truly *',
                   '* anyone you know *'
  )
  or regex.icontains(body.current_thread.text,
                     'if you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested',
                     '(?:any|some)one[^\r\n]{0,20}(is|will|would|might be)[^\r\n]{0,20}interested',
                     'who (?:will|would|might) appreciate'
  )
  or (
    any(regex.extract(body.current_thread.text,
                      "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
        ),
        strings.parse_email(.full_match).domain.domain in $free_email_providers
        or strings.parse_email(.full_match).domain.root_domain in $free_email_providers
    )
    or (
      length(headers.reply_to) > 0
      and sender.email.email not in map(headers.reply_to, .email.email)
    )
    or length(recipients.to) == 0
    or regex.icontains(body.current_thread.text,
                       '(?:call|contact|text)[^\r\n]{0,50} at'
    )
    or regex.icontains(body.current_thread.text,
                       '(?:private|personal|primary) (?:e-?)?mail'
    )
    or strings.icontains(body.current_thread.text,
                         'happy to answer any questions you may have'
    )
    or strings.icontains(body.current_thread.text, ' kindly ')
    or strings.icontains(body.current_thread.text, ' (kindly ')
  )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started