Service abuse: Zoom Clips with unregistered reply-to domain

calendar Jul 17, 2026 · Attack surface reduction  ·
Share on: linkedin copy

Detects messages sent through legitimate Zoom infrastructure sharing a clip, where the reply-to domain has no registered WHOIS record.

Sublime rule (View on GitHub)

 1name: "Service abuse: Zoom Clips with unregistered reply-to domain"
 2description: "Detects messages sent through legitimate Zoom infrastructure sharing a clip, where the reply-to domain has no registered WHOIS record."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  // Legitimate zoom sending infrastructure
 8  and sender.email.email == "no-reply@zoom.us"
 9  // sharing a clip
10  and strings.starts_with(subject.base, 'Clips')
11  // reply-to domain is not registered
12  and (network.whois(headers.reply_to[0].email.domain).found == false)  
13tags:
14  - "Attack surface reduction"
15attack_types:
16  - "Spam"
17tactics_and_techniques:
18  - "Social engineering"
19  - "Evasion"
20detection_methods:
21  - "Sender analysis"
22  - "Header analysis"
23  - "Whois"
24id: "a00900fd-1b91-568e-ab9b-bd33873af253"

Related rules

to-top