Headers: Randomized mailer identifier string

calendar Nov 12, 2026  ·
Share on: linkedin copy

Flags inbound messages whose Mailer header contains a randomly generated alphanumeric string following a consistent 'Mailer-' pattern, a signature of mass-mailing tools used to distribute bulk fraudulent messages. Observed samples reuse the same fake ACH payment disbursement/order status subject line while rotating across many unrelated sender addresses and domains, a tactic designed to evade sender-based filtering and push recipients toward fraudulent payment or financial lures.

Sublime rule (View on GitHub)

 1name: "Headers: Randomized mailer identifier string"
 2description: "Flags inbound messages whose Mailer header contains a randomly generated alphanumeric string following a consistent 'Mailer-' pattern, a signature of mass-mailing tools used to distribute bulk fraudulent messages. Observed samples reuse the same fake ACH payment disbursement/order status subject line while rotating across many unrelated sender addresses and domains, a tactic designed to evade sender-based filtering and push recipients toward fraudulent payment or financial lures."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and regex.imatch(headers.mailer, 'Mailer-[a-z0-9]{6,12}')  
 8attack_types:
 9  - "Credential Phishing"
10  - "BEC/Fraud"
11tactics_and_techniques:
12  - "Social engineering"
13  - "Spoofing"
14  - "Evasion"
15detection_methods:
16  - "Header analysis"
17  - "Sender analysis"
18id: "952eb868-38eb-50d1-a0c4-b07a8d3d3b1d"
to-top