
Summary
This rule detects inbound messages that contain links to Blogspot domains hosting explicit romance content, using a combination of URL scrutiny and natural language processing (NLP) of the message body. Specifically, it triggers when a message includes a link whose root_domain equals blogspot.com and the NLP classifier for the thread text returns a topic named "Sexually Explicit Messages." The detection is categorized as Spam with a medium severity level. The rule combines data from the message structure (inbound context and embedded URLs) with automated topic classification to identify potential social-engineering or deceptive content tied to explicit material hosted on a free subdomain platform. Detection methods include URL analysis and Natural Language Understanding. Considerations include potential false positives for legitimate content linking to blogspot.com and the reliance on a single NLP topic label, which may vary across classifiers or languages. Recommendations for improvement include broadening domain matching to cover blogspot subdomains (e.g., blogspot.*), incorporating additional content signals, and adding reputation checks for the hosting domains to reduce false positives while preserving visibility into potential spam campaigns.
Categories
- Web
Data Sources
- Application Log
- Network Traffic
- Process
Created: 2026-03-10