Low Severity

Spam: Cold outreach from Cloudflare-hosted newly registered domain

Labels

Spam

Evasion

Social engineering

Whois

Natural Language Understanding

Content analysis

Description

Flags inbound messages from sender domains that were registered fewer than 70 days ago and use exactly two Cloudflare name servers with subdomains ending in '.ns'. The rule further requires that the subject or body text be classified as B2B cold outreach by the NLU model, that the body be short (under 350 characters), and that the sender's TLD not be on the suspicious TLD list, indicating abuse of Cloudflare's free DNS infrastructure to rapidly stand up new domains for outreach-style spam.

References

No references.

Sublime Security

Created Aug 4th, 2026 • Last updated Aug 4th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
// newly registered sender domain
and network.whois(sender.email.domain).days_old < 90
// there are 2 name servers which have subdomains ending with .ns
and length(network.whois(sender.email.domain).name_servers) == 2
and all(network.whois(sender.email.domain).name_servers,
        strings.iends_with(.subdomain, '.ns')
        and .root_domain == 'cloudflare.com'
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == 'B2B Cold Outreach'
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.