• Sublime Core Feed
Low Severity

Spam: New job cold outreach from unsolicited sender

Description

Detects unsolicited messages congratulating recipients on new jobs or roles that contain unsubscribe links, calendar booking links, or exhibit B2B cold outreach characteristics from senders who have not been previously contacted.

References

No references.

Sublime Security
Created Sep 29th, 2025 • Last updated Sep 29th, 2025
Source
type.inbound
// direct outreach to sender
and length(recipients.to) == 1
// talking about new job
and any([body.current_thread.text, subject.subject],
        regex.icontains(., 'congrat(?:ulation)?s on the new (?:job|gig|role)')
)
// body link to unsubscribe or to book time, otherwise use NLU on the body current thread
and (
  any(body.links,
      strings.icontains(.href_url.url, "unsubscribe")
      or strings.icontains(.href_url.url, "opt-out")
      or strings.icontains(.href_url.url, "preferences")
      or strings.icontains(.href_url.url, "calendar")
  )
  or any(ml.nlu_classifier(body.current_thread.text).topics,
         .name == "B2B Cold Outreach" and .confidence != "low"
  )
)
// not someone they have reached out to before
and not profile.by_sender().solicited
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started