Service abuse: Notion free-tier account impersonating VIP

calendar Jul 14, 2026 · Attack surface reduction  ·
Share on: linkedin copy

Detects messages sent from Notion's legitimate notification address (notify@mail.notion.so) that pass SPF and DMARC checks, but where the sender's display name matches an internal VIP, and the embedded links resolve to a Notion workspace associated with a free-tier subscription. This pattern indicates abuse of Notion's free tier to craft convincing internal impersonation lures.

Sublime rule (View on GitHub)

 1name: "Service abuse: Notion free-tier account impersonating VIP"
 2description: "Detects messages sent from Notion's legitimate notification address (notify@mail.notion.so) that pass SPF and DMARC checks, but where the sender's display name matches an internal VIP, and the embedded links resolve to a Notion workspace associated with a free-tier subscription. This pattern indicates abuse of Notion's free tier to craft convincing internal impersonation lures."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.email == 'notify@mail.notion.so'
 8  // from VIP
 9  and any($org_vips, strings.icontains(sender.display_name, .display_name))
10  and any(body.current_thread.links,
11          any(ml.link_analysis(.).additional_responses,
12              .json['statsigUser']['custom']['spaceSubscriptionTier'] == 'free'
13          )
14  )  
15tags:
16  - "Attack surface reduction"
17attack_types:
18  - "Credential Phishing"
19tactics_and_techniques:
20  - "Impersonation: VIP"
21  - "Social engineering"
22detection_methods:
23  - "Sender analysis"
24  - "Header analysis"
25  - "URL analysis"
26  - "Content analysis"
27id: "966562cb-78b2-5844-a200-d12321df4472"

Related rules

to-top