Evasion: Credential phishing with newly registered domain redirecting to Wikipedia

calendar Oct 1, 2026  ·
Share on: linkedin copy

Flags inbound messages where natural language understanding detects credential theft intent in the message body, combined with a link pointing to a domain registered within the last 30 days that resolves to Wikipedia, indicating evasion of link analysis through a benign-looking redirect destination.

Sublime rule (View on GitHub)

 1name: "Evasion: Credential phishing with newly registered domain redirecting to Wikipedia"
 2description: "Flags inbound messages where natural language understanding detects credential theft intent in the message body, combined with a link pointing to a domain registered within the last 30 days that resolves to Wikipedia, indicating evasion of link analysis through a benign-looking redirect destination."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(ml.nlu_classifier(body.current_thread.text).intents,
 8          .name == 'cred_theft' and .confidence != 'low'
 9  )
10  and any(body.current_thread.links,
11          network.whois(.href_url.domain).days_old < 30
12          and ml.link_analysis(.).effective_url.url in (
13            'https://www.wikipedia.org/'
14          )
15  )  
16attack_types:
17  - "Credential Phishing"
18tactics_and_techniques:
19  - "Evasion"
20  - "Social engineering"
21detection_methods:
22  - "Natural Language Understanding"
23  - "URL analysis"
24  - "Whois"
25id: "ae1f1fa1-bd08-571a-bf8a-18fafc73c064"
to-top