heroui logo

Reconnaissance: Fake real estate inquiry with empty body

Sublime Rules

View Source
Summary
This rule detects inbound messages that have no body content in either plain text or HTML, yet carry an unusually long subject line (>150 characters) containing real estate inquiry language. It flags messages whose subject base matches phrases such as "purchase a home", references to a property listing (e.g., "the listing on/at"), or relocation-related language (e.g., "interested in/relocating this property"), which are common in reconnaissance aimed at fraud. By requiring an empty body and a verbose subject with targeted real estate terms, the rule aims to identify social-engineering BEC/fraud attempts that attempt to establish contact with real estate professionals under relocation or listing-focused pretexts. Detection relies on content analysis of the message subject and body, alongside sender analysis to assess impersonation risks. This rule applies to inbound messages and leverages networks and application-processing telemetry that capture email content for evaluation. It is intended to reduce false positives by combining body emptiness with specific subject indicators rather than standalone subject keywords. The alert is categorized as medium severity and aligned with BEC/Fraud and social engineering techniques.
Categories
  • Web
  • Network
Data Sources
  • Network Traffic
  • Application Log
Created: 2026-07-09