Link: Fake video link from newly registered domain

calendar Sep 8, 2026  ·
Share on: linkedin copy

Detects inbound messages from a sender whose domain was registered less than 30 days ago, containing a link with a path resembling a video file URL structure ('.mp4/views/').

Sublime rule (View on GitHub)

 1name: "Link: Fake video link from newly registered domain"
 2description: "Detects inbound messages from a sender whose domain was registered less than 30 days ago, containing a link with a path resembling a video file URL structure ('.mp4/views/')."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and network.whois(sender.email.domain).days_old < 30
 8  and any(body.current_thread.links,
 9          strings.contains(.href_url.path, ".mp4/views/")
10  )  
11attack_types:
12  - "Malware/Ransomware"
13tactics_and_techniques:
14  - "Social engineering"
15detection_methods:
16  - "Whois"
17  - "URL analysis"
18  - "Sender analysis"
19id: "dc1f5d72-233b-5c20-8573-bdebf23552ce"
to-top