heroui logo

Spam: VertiStream email warmup messages with transaction ID artifact

Sublime Rules

View Source
Summary
Detects VertiStream inbound email warm-up messages used in B2B lead-gen operations. The rule triggers on inbound messages with no attachments and no non-mailto links, containing an empty HTML div with class transactionid and an id that matches a UUID pattern. The body is typically a short excerpt from an article or talk with punctuation stripped. These messages are often sent from freemail accounts or lookalike domains tied to VertiStream's campaigns. The rule relies on HTML analysis (presence of the transactionid div) and content checks (empty div and UUID-id), verified via an XPath query for the div and a regex for the UUID format, along with a check that the message has inbound direction and no external links. It is designed to detect spam-like warm-up activity associated with social engineering for lead generation.
Categories
  • Network
  • Application
Data Sources
  • Network Traffic
  • Application Log
Created: 2026-11-09