Medium Severity

Spam: Large financial amount mention from newly registered sender domain

Description

Detects inbound messages from domains less than 180 days old that solicit investment interest from named organizations or individuals on behalf of a purported private family office. Senders use financial-sounding names and rotate first names and target company names while keeping the subject line structure nearly identical. The outreach is designed to appear as a legitimate investment inquiry to bait a response.

References

No references.

Sublime Security
Created Aug 3rd, 2026 • Last updated Aug 3rd, 2026
Source
type.inbound
and network.whois(sender.email.domain).days_old < 180
and any([body.html.display_text, subject.base],
        regex.icontains(., '\$\d\p{Pd}\$\d{1,2}(?:m\b|million)')
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started