sublimelowRule

Spam: Suspicious toll-free phone number

Detects messages containing phone numbers 1 800-555-0199 or 1 800-555-0299 in the subject or body, which is reserved for use by the entertainment industry. Commonly used as a placeholder phone number in LLM-generated campaigns.

MITRE ATT&CK

T1566 T1598

initial-access

Detection Query

type.inbound
and any([body.current_thread.text, subject.subject],
        regex.icontains(., '\b\+?(\d{1}.)?\(?8\d{2}?\)?.555.?0[12]99\b')
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Spam: Suspicious toll-free phone number"
description: "Detects messages containing phone numbers 1 800-555-0199 or 1 800-555-0299 in the subject or body, which is reserved for use by the entertainment industry. Commonly used as a placeholder phone number in LLM-generated campaigns."
type: "rule"
severity: "low"
source: |
  type.inbound
  and any([body.current_thread.text, subject.subject],
          regex.icontains(., '\b\+?(\d{1}.)?\(?8\d{2}?\)?.555.?0[12]99\b')
  )
tags:
 - "Attack surface reduction"
attack_types:
  - "Spam"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "Content analysis"
id: "d9766109-6574-5fd8-9c07-d606d3ce82d2"