Link: Free file host link with 'Important Viewing Note' lure

calendar Jul 15, 2026  ·
Share on: linkedin copy

Detects inbound messages containing links to free file hosting domains paired with the phrase 'important viewing note' in the message body. These messages often masquerade as institutional or educational communications — such as student conduct reports or advancement initiatives — to add legitimacy and encourage recipients to follow the hosted link.

Sublime rule (View on GitHub)

 1name: "Link: Free file host link with 'Important Viewing Note' lure"
 2description: "Detects inbound messages containing links to free file hosting domains paired with the phrase 'important viewing note' in the message body. These messages often masquerade as institutional or educational communications — such as student conduct reports or advancement initiatives — to add legitimacy and encourage recipients to follow the hosted link."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links, .href_url.domain.domain in $free_file_hosts)
 8  and strings.icontains(body.current_thread.text, 'important viewing note')  
 9attack_types:
10  - "Credential Phishing"
11tactics_and_techniques:
12  - "Free file host"
13  - "Social engineering"
14  - "Impersonation: Brand"
15detection_methods:
16  - "Content analysis"
17  - "URL analysis"
18  - "Threat intelligence"
19id: "6b5e1f55-1143-533d-8342-726373dc7f10"
to-top