Spam: VertiStream warm-up HTML template

calendar Nov 9, 2026  ·
Share on: linkedin copy

Detects VertiStream warm-up messages by the generator's styled paragraph markup under an unpunctuated article title, with or without the transaction ID artifact or a trailing ellipsis.

Sublime rule (View on GitHub)

 1name: "Spam: VertiStream warm-up HTML template"
 2description: "Detects VertiStream warm-up messages by the generator's styled paragraph markup under an unpunctuated article title, with or without the transaction ID artifact or a trailing ellipsis."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(filter(body.current_thread.links, .href_url.scheme != "mailto")) == 0
 8  and length(attachments) == 0
 9  and not subject.is_reply
10  and not subject.is_forward
11  and not subject.is_auto_reply
12  // generator markup: a styled <p> holding only unpunctuated text, sometimes ending in "..."
13  // <p style="font-family:Bookman Old Style, serif; color: #9400D3;">Tipping once contained to ...</p>
14  and regex.icontains(body.html.raw,
15                      '<p style=["'']font-family:[^;"'']+; ?color: ?#[0-9a-f]{6};?["'']>[a-z0-9\s]*(?:\.\.\.|…)?\s*</p>'
16  )
17  // warning banners can add a few paragraphs, but not a full message
18  and strings.icount(body.html.raw, '</p>') <= 4
19  // unpunctuated multi-word title
20  and regex.icontains(subject.base, '\w\s+\w')
21  and regex.imatch(subject.base, '[\s[:punct:]\p{P}]{0,3}[^[:punct:]\p{P}]+')  
22attack_types:
23  - "Spam"
24tactics_and_techniques:
25  - "Social engineering"
26detection_methods:
27  - "Content analysis"
28  - "HTML analysis"
29id: "bb688ddf-dc4e-5c45-a64a-18d02386bc69"
to-top