Evasion: Suspicious TLD link redirecting to Wikipedia

calendar Aug 21, 2026  ·
Share on: linkedin copy

Flags inbound messages containing links with domains registered under suspicious top-level domains that redirect to Wikipedia when analyzed. This behavior indicates the link is detecting automated sandbox or security analysis tools and serving benign content to evade detection, while likely delivering malicious content to real users.

Sublime rule (View on GitHub)

 1name: "Evasion: Suspicious TLD link redirecting to Wikipedia"
 2description: "Flags inbound messages containing links with domains registered under suspicious top-level domains that redirect to Wikipedia when analyzed. This behavior indicates the link is detecting automated sandbox or security analysis tools and serving benign content to evade detection, while likely delivering malicious content to real users."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .href_url.domain.tld in $suspicious_tlds
 9          and ml.link_analysis(.).effective_url.url in (
10            'https://www.wikipedia.org/'
11          )
12  )  
13attack_types:
14  - "Credential Phishing"
15  - "Spam"
16tactics_and_techniques:
17  - "Evasion"
18  - "Open redirect"
19detection_methods:
20  - "URL analysis"
21id: "c4567096-6e36-578e-b070-a51c01953287"
to-top