Body: CSS clamp() font obfuscation with IP-based links

calendar Jul 29, 2026  ·
Share on: linkedin copy

Detects inbound messages using a CSS evasion technique where font-size or line-height properties are set using the clamp() function with very small or negative values — a method used to hide or manipulate rendered text and evade content-based detection. Messages matching this pattern also contain at least one hyperlink resolving directly to an IP address rather than a domain. Observed lures span a wide range of social engineering themes including urgent account alerts, financial offers, storage login codes, service cancellations, and renewal reminders.

Sublime rule (View on GitHub)

 1name: "Body: CSS clamp() font obfuscation with IP-based links"
 2description: "Detects inbound messages using a CSS evasion technique where font-size or line-height properties are set using the clamp() function with very small or negative values — a method used to hide or manipulate rendered text and evade content-based detection. Messages matching this pattern also contain at least one hyperlink resolving directly to an IP address rather than a domain. Observed lures span a wide range of social engineering themes including urgent account alerts, financial offers, storage login codes, service cancellations, and renewal reminders."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      regex.icontains(body.html.raw,
10                      '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
11      )
12      and any(body.links, .href_url.ip.ip is not null)
13    )
14    or any(attachments,
15           (.content_type == "message/rfc822" or .file_extension =~ "eml")
16           and regex.icontains(file.parse_eml(.).body.html.raw,
17                               '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
18           )
19           and any(file.parse_eml(.).body.links, .href_url.ip.ip is not null)
20    )
21  )  
22attack_types:
23  - "Credential Phishing"
24tactics_and_techniques:
25  - "Evasion"
26  - "Social engineering"
27detection_methods:
28  - "HTML analysis"
29  - "URL analysis"
30  - "Content analysis"
31id: "0eaf1193-22e2-5cc2-845c-4f8f26b48ab2"
to-top