Spam: VertiStream/SenderTeam marketing messages with transaction ID artifact

calendar Nov 9, 2026  ·
Share on: linkedin copy

Detects B2B content-syndication lead-gen messages from VertiStream and its sister sending identity SenderTeam: inbound mail with links and no attachments that contains an empty HTML div with a 'transactionid' class and a UUID id. Both embed this element in their sponsor-branded content offers, sent from bulk-registered, tech-themed compound domains. The same element appears in VertiStream's linkless warm-up messages.

Sublime rule (View on GitHub)

 1name: "Spam: VertiStream/SenderTeam marketing messages with transaction ID artifact"
 2description: "Detects B2B content-syndication lead-gen messages from VertiStream and its sister sending identity SenderTeam: inbound mail with links and no attachments that contains an empty HTML div with a 'transactionid' class and a UUID id. Both embed this element in their sponsor-branded content offers, sent from bulk-registered, tech-themed compound domains. The same element appears in VertiStream's linkless warm-up messages."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(filter(body.current_thread.links, .href_url.scheme != "mailto")) > 0
 8  and length(attachments) == 0
 9  and strings.icontains(body.html.raw, 'class="transactionid"')
10  // verify the extracted div exactly: empty, with a uuid id
11  and any(html.xpath(body.html, "//div[@class='transactionid']").nodes,
12          regex.imatch(.raw,
13                       '<div class="transactionid" id="[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"></div>'
14          )
15  )  
16attack_types:
17  - "Spam"
18tactics_and_techniques:
19  - "Social engineering"
20detection_methods:
21  - "HTML analysis"
22id: "9b1287f6-2c72-5e39-b09d-24b2b48eb387"
to-top