Low Severity

Spam: Cold outreach from Cloudflare-hosted newly registered domain

Labels

Spam

Evasion

Social engineering

Whois

Natural Language Understanding

Content analysis

Description

Flags inbound messages from sender domains that were registered fewer than 365 days ago and use exactly two Cloudflare name servers with subdomains ending in '.ns'. The rule further requires that the subject or body text be classified as B2B cold outreach by the NLU model, indicating abuse of Cloudflare's free DNS infrastructure to rapidly stand up new domains for outreach-style spam.

References

No references.

Sublime Security

Created Aug 4th, 2026 • Last updated Aug 17th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
// newly registered sender domain
and network.whois(sender.email.domain).days_old < 365
// there are 2 name servers which have subdomains ending with .ns
and length(network.whois(sender.email.domain).name_servers) == 2
and all(network.whois(sender.email.domain).name_servers,
        strings.iends_with(.subdomain, '.ns')
        and .root_domain == 'cloudflare.com'
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == 'B2B Cold Outreach'
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.