Low Severity

Service abuse: Kagoya.net-hosted domains sending English business lures

Description

Flags inbound mail routed through infrastructure tied to the Japanese hosting provider Kagoya.net where the message body is written in English, a mismatch that surfaces abuse of these mail servers for business-themed lures.

References

No references.

Sublime Security
Created Aug 27th, 2026 • Last updated Aug 27th, 2026
Source
type.inbound
and any(headers.domains, .root_domain == "kagoya.net")
and ml.nlu_classifier(body.current_thread.text).language == "english"
and not (
  (length(headers.references) > 0 or headers.in_reply_to is not null)
  and (subject.is_forward or subject.is_reply)
  and length(body.previous_threads) >= 1
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started