Link: Credential phishing via appspot.com hosting

calendar Nov 4, 2026  ·
Share on: linkedin copy

Detects inbound messages containing a link hosted on an appspot.com subdomain, with credential theft intent in the message body. Trusted sender domains are excluded unless they fail DMARC authentication.

Sublime rule (View on GitHub)

 1name: "Link: Credential phishing via appspot.com hosting"
 2description: "Detects inbound messages containing a link hosted on an appspot.com subdomain, with credential theft intent in the message body. Trusted sender domains are excluded unless they fail DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // link is a PaaS hosting appspot.com domain
 8  and any(body.current_thread.links,
 9          strings.ends_with(.href_url.domain.domain, ".r.appspot.com")
10  )
11  
12  // cred theft present
13  and any(ml.nlu_classifier(body.current_thread.text).intents,
14          .name == "cred_theft"
15  )
16  
17  // negate highly trusted sender domains unless they fail DMARC authentication
18  and not (
19    sender.email.domain.root_domain in $high_trust_sender_root_domains
20    and coalesce(headers.auth_summary.dmarc.pass, false)
21  )  
22attack_types:
23  - "Credential Phishing"
24tactics_and_techniques:
25  - "Free subdomain host"
26  - "Social engineering"
27detection_methods:
28  - "URL analysis"
29  - "Natural Language Understanding"
30  - "Header analysis"
31id: "fde96515-9a15-5a76-b7e0-70b74593d350"
to-top