Spam: VertiStream/SenderTeam consent disclaimer

calendar Nov 10, 2026  ·
Share on: linkedin copy

Detects B2B content-syndication spam from VertiStream and its sister sending identity SenderTeam by the disclaimer they append to sponsored content offers and surveys: an 'Offered on behalf of' sponsor line followed by a statement that engaging with the email consents to sharing the recipient's data with the sponsor for sales follow-up. The disclaimer appears across every sending channel the network uses, including mail without a transaction ID element or a known tracking-link format.

Sublime rule (View on GitHub)

 1name: "Spam: VertiStream/SenderTeam consent disclaimer"
 2description: "Detects B2B content-syndication spam from VertiStream and its sister sending identity SenderTeam by the disclaimer they append to sponsored content offers and surveys: an 'Offered on behalf of' sponsor line followed by a statement that engaging with the email consents to sharing the recipient's data with the sponsor for sales follow-up. The disclaimer appears across every sending channel the network uses, including mail without a transaction ID element or a known tracking-link format."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(attachments) == 0
 8  and strings.icontains(body.current_thread.text, 'Offered on behalf of')
 9  // "By engaging with the content of this email, you agree..."
10  // "By interacting with this email's content, you are agreeing..."
11  and regex.icontains(body.current_thread.text,
12                      'By (?:engaging|interacting) with (?:the content of this email|this email.s content), you (?:agree|are agreeing) that your data may be shared with'
13  )  
14attack_types:
15  - "Spam"
16tactics_and_techniques:
17  - "Social engineering"
18detection_methods:
19  - "Content analysis"
20id: "ec57e532-9731-569c-ba05-f6c61dc0c1aa"
to-top