• Sublime Core Feed
Low Severity

Spam: Website errors solicitation

Description

This rule detects messages claiming to have identified errors on a website. The messages typically offer to send pricing or information upon request.

References

No references.

Sublime Security
Created Oct 30th, 2025 • Last updated Dec 11th, 2025
Source
type.inbound
and not profile.by_sender().solicited
// no attachments
and length(attachments) == 0
// subject must contain SEO or web dev spam keywords or be short
and (
  (
    // SEO or web development service keywords
    regex.icontains(strings.replace_confusables(subject.subject),
                    "(?:proposal|cost|estimate|error|bug|audit|screenshot|strategy|rankings|issues|fix|website|design)"
    )
    // report and follow up keywords
    or (
      strings.icontains(strings.replace_confusables(subject.subject), "report")
      and regex.icontains(strings.replace_confusables(body.current_thread.text),
                          "(?:free|send you|can i send|may i send|let me know|interested|get back to me|reply back|just reply)"
      )
    )
    // short subject
    or length(subject.base) < 5
  )
  // or a reply or forward in a thread that mentions website or screenshots
  or (
    (length(subject.base) < 5 or subject.is_reply or subject.is_forward)
    and any(body.previous_threads,
            regex.icontains(strings.replace_confusables(.text),
                            "(?:screenshot|website)"
            )
    )
  )
)
// body structure and content patterns
and (
  // Single thread with no links
  (
    length(body.links) == 0
    and length(body.previous_threads) == 0
    // short message between 20 and 500 chars
    and 20 < length(body.current_thread.text) < 500
    // service offering keywords
    and regex.icontains(strings.replace_confusables(body.current_thread.text),
                        "(?:screenshot|error list|plan|quote|rank|professional|price|mistake)"
    )
    // generic greeting
    and regex.icontains(strings.replace_confusables(body.current_thread.text),
                        'h(?:i|ello|ey)\b'
    )
    // problem or urgency keywords
    and regex.icontains(strings.replace_confusables(body.current_thread.text),
                        '(?:error|report|issues|website|repair|redesign|upgrade|Google\s+.{0,15}find it)'
    )
    // website or page mention
    and regex.icontains(strings.replace_confusables(body.current_thread.text),
                        "(?:site|website|page)"
    )
  )
  // Single thread with only unsubscribe link
  or (
    length(body.links) == 1
    and (
      // unsubscribe mailto link
      regex.icontains(body.html.raw, "mailto:*[++unsubscribe@]")
      // or link to found in org_domains
      or any(body.links, .href_url.domain.root_domain in~ $org_domains)
    )
    and length(body.previous_threads) == 0
    // short message between 20 and 500 chars
    and 20 < length(body.current_thread.text) < 500
    // service offering keywords
    and regex.icontains(strings.replace_confusables(body.current_thread.text),
                        "(?:screenshot|error list|plan|quote|rank|professional|price|mistake)"
    )
    // generic greeting
    and regex.icontains(strings.replace_confusables(body.current_thread.text),
                        '(?:h(?:i|ello|ey)|morning)\b'
    )
    // problem or urgency keywords
    and regex.icontains(strings.replace_confusables(body.current_thread.text),
                        '(?:error|report|issues|website|repair|redesign|upgrade|Google\s+.{0,15}find it)'
    )
    // website or page mention
    and regex.icontains(strings.replace_confusables(body.current_thread.text),
                        "(?:site|website|page)"
    )
  )
  // Multiple thread messages
  or (
    length(body.links) == 0
    // small thread with less than 5 messages
    and length(body.previous_threads) < 5
    // check previous messages for spam characteristics
    and any(body.previous_threads,
            // short previous messages less than 400 chars
            length(.text) < 400
            and (
              // generic greeting
              regex.icontains(strings.replace_confusables(.text),
                              '(?:h(?:i|ello|ey)|morning)\b'
              )
              // service offering keywords
              and regex.icontains(strings.replace_confusables(.text),
                                  '(?:\berror(?:\s+list)?\b|screenshot|report|plan)'
              )
              // previous threads written in English
              and ml.nlu_classifier(.text).language == "english"
            )
    )
  )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started