Link: Credential theft via newly registered suspicious domain in query parameter

calendar Oct 9, 2026  ·
Share on: linkedin copy

Detects inbound messages where NLU classification identifies credential theft intent in the message body, and a link contains a query parameter that decodes to a URL with a suspicious top-level domain registered within the last 30 days. Excludes messages from high-trust sender domains that pass DMARC authentication.

Sublime rule (View on GitHub)

 1name: "Link: Credential theft via newly registered suspicious domain in query parameter"
 2description: "Detects inbound messages where NLU classification identifies credential theft intent in the message body, and a link contains a query parameter that decodes to a URL with a suspicious top-level domain registered within the last 30 days. Excludes messages from high-trust sender domains that pass DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(ml.nlu_classifier(body.current_thread.text).intents,
 8          .name == 'cred_theft' and .confidence != 'low'
 9  )
10  and any(filter(body.current_thread.links, .href_url.scheme != 'mailto'),
11          any(flatten(values(.href_url.query_params_decoded)),
12              strings.parse_url(.).domain.valid
13              and strings.parse_url(.).domain.tld in $suspicious_tlds
14              and network.whois(strings.parse_url(.).domain).days_old < 30
15          )
16  )
17  and not (
18    (
19      sender.email.domain.root_domain in $high_trust_sender_root_domains
20      or sender.email.domain.root_domain in ("supabase.io")
21    )
22    and coalesce(headers.auth_summary.dmarc.pass, false)
23  )  
24attack_types:
25  - "Credential Phishing"
26tactics_and_techniques:
27  - "Social engineering"
28  - "Open redirect"
29detection_methods:
30  - "Natural Language Understanding"
31  - "URL analysis"
32  - "Whois"
33  - "Sender analysis"
34id: "c3d1059f-9f1e-5c37-b688-7076e7862c4f"
to-top