
Summary
A rule that detects B2B content-syndication spam from VertiStream and its SenderTeam by identifying a sponsor disclaimer appended to sponsored offers and surveys. The disclaimer uses an 'Offered on behalf of' sponsor line followed by language stating that engaging with the email's content permits sharing the recipient's data with the sponsor for sales follow-up. The detection targets inbound emails with no attachments (length(attachments) == 0) and analyzes body.current_thread.text for the phrases 'Offered on behalf of' and a regex capturing variations of 'By engaging with this email's content, you/you are agreeing that your data may be shared with'. This rule operates on network-traffic data and is intended to flag content-syndication spam that uses consent-based data sharing as a lure across multiple sending channels, regardless of transaction IDs or tracking links. It relies on content analysis to identify the tactic and supports filtering and alerting for this specific threat vector in inbound mail streams.
Categories
- Network
Data Sources
- Network Traffic
Created: 2026-11-10