Medium Severity

Service abuse: Zohodesk reply-to mismatch with job scam indicators

Description

Detects inbound messages sent from Zohodesk infrastructure where the reply-to address points to a domain outside of Zohodesk, combined with natural language signals indicating job scam content. This technique abuses legitimate Zohodesk services to add credibility while redirecting responses to an external actor-controlled address.

References

No references.

Sublime Security
Created Jul 22nd, 2026 • Last updated Jul 22nd, 2026
Source
type.inbound
and sender.email.domain.root_domain == "zohodesk.com"
and any(headers.reply_to, .email.domain.root_domain != "zohodesk.com")
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "job_scam" and .confidence != "low"
  )
  // nlu fallback where we don't get job scam
  or strings.icontains(body.current_thread.text, "talent acquisition")
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started