
Spam: VertiStream/SenderTeam marketing messages with transaction ID artifact
Sublime Rules
View SourceSummary
Detects B2B marketing/spam campaigns attributed to VertiStream and SenderTeam in inbound emails. The rule flags messages that contain links (not mailto) and have no attachments, and that include a specific HTML artifact: an empty div element with class "transactionid" and an id that is a UUID. It verifies the div exactly via an XPath check for //div[@class='transactionid'] and a regex ensuring the id matches a UUID pattern (8-4-4-4-12 hex digits) and that the div is empty (<div class="transactionid" id="<uuid>"></div>). The artifact is embedded in sponsor-branded content offers distributed from bulk-registered, tech-themed compound domains, and also appears in VertiStream’s linkless warm-up messages. The rule relies on HTML analysis of the email body to distinguish this campaign from legitimate messages by detecting this precise artifact within inbound content that includes links but no attachments, enabling attribution to VertiStream/SenderTeam marketing activity.
Categories
- Web
- Application
Data Sources
- Web Credential
- Application Log
- Network Traffic
Created: 2026-11-10