Spam: VertiStream email warmup messages with transaction ID artifact

calendar Nov 9, 2026  ·
Share on: linkedin copy

Detects VertiStream email warm-up messages: inbound mail with no attachments and no non-mailto links that contains an empty HTML div with a 'transactionid' class and a UUID id. The body is typically a single excerpt from a real article or talk with punctuation stripped, sent from freemail accounts or bulk-registered lookalike domains tied to VertiStream's B2B lead-gen operation.

Sublime rule (View on GitHub)

 1name: "Spam: VertiStream email warmup messages with transaction ID artifact"
 2description: "Detects VertiStream email warm-up messages: inbound mail with no attachments and no non-mailto links that contains an empty HTML div with a 'transactionid' class and a UUID id. The body is typically a single excerpt from a real article or talk with punctuation stripped, sent from freemail accounts or bulk-registered lookalike domains tied to VertiStream's B2B lead-gen operation."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(filter(body.current_thread.links, .href_url.scheme != "mailto")) == 0
 8  and length(attachments) == 0
 9  and strings.icontains(body.html.raw, 'class="transactionid"')
10  // verify the extracted div exactly: empty, with a uuid id
11  and any(html.xpath(body.html, "//div[@class='transactionid']").nodes,
12          regex.imatch(.raw,
13                       '<div class="transactionid" id="[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"></div>'
14          )
15  )  
16attack_types:
17  - "Spam"
18tactics_and_techniques:
19  - "Social engineering"
20detection_methods:
21  - "HTML analysis"
22  - "Content analysis"
23id: "359200e9-5e82-54e3-82a5-7ef3234c0ea9"
to-top