heroui logo

Service abuse: Google Calendar notification with callback scam language

Sublime Rules

View Source
Summary
Detects inbound messages originating from Google’s calendar notification service that contain language indicative of a callback scam, suggesting abuse of the calendar sharing feature to disseminate fraudulent content. The rule asserts that the sender email equals calendar-notification@google.com and uses an NLP classifier on the thread body (body.current_thread.text) to identify intents named
Categories
  • Web
Data Sources
  • Network Traffic
  • Application Log
Created: 2026-03-17