Spam: Cold outreach from Cloudflare-hosted newly registered domain

calendar Aug 4, 2026  ·
Share on: linkedin copy

Flags inbound messages from sender domains that were registered fewer than 70 days ago and use exactly two Cloudflare name servers with subdomains ending in '.ns'. The rule further requires that the subject or body text be classified as B2B cold outreach by the NLU model, that the body be short (under 350 characters), and that the sender's TLD not be on the suspicious TLD list, indicating abuse of Cloudflare's free DNS infrastructure to rapidly stand up new domains for outreach-style spam.

Sublime rule (View on GitHub)

 1name: "Spam: Cold outreach from Cloudflare-hosted newly registered domain"
 2description: "Flags inbound messages from sender domains that were registered fewer than 70 days ago and use exactly two Cloudflare name servers with subdomains ending in '.ns'. The rule further requires that the subject or body text be classified as B2B cold outreach by the NLU model, that the body be short (under 350 characters), and that the sender's TLD not be on the suspicious TLD list, indicating abuse of Cloudflare's free DNS infrastructure to rapidly stand up new domains for outreach-style spam."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  // newly registered sender domain
 8  and network.whois(sender.email.domain).days_old < 90
 9  // there are 2 name servers which have subdomains ending with .ns
10  and length(network.whois(sender.email.domain).name_servers) == 2
11  and all(network.whois(sender.email.domain).name_servers,
12          strings.iends_with(.subdomain, '.ns')
13          and .root_domain == 'cloudflare.com'
14  )
15  and any(ml.nlu_classifier(body.current_thread.text).topics,
16          .name == 'B2B Cold Outreach'
17  )  
18attack_types:
19  - "Spam"
20tactics_and_techniques:
21  - "Evasion"
22  - "Social engineering"
23detection_methods:
24  - "Whois"
25  - "Natural Language Understanding"
26  - "Content analysis"
27id: "ce0a2f77-7dbb-52d7-9e16-6c6ac854b783"
to-top