Link: Fake webmail hosting

calendar Sep 9, 2026  ·
Share on: linkedin copy

Detects inbound messages that impersonate a webmail hosting service by including an HTML heading referencing 'Webmail HostingServer' or by using a link whose display text and destination are both set to an email address (support@webmail.com).

Sublime rule (View on GitHub)

 1name: "Link: Fake webmail hosting"
 2description: "Detects inbound messages that impersonate a webmail hosting service by including an HTML heading referencing 'Webmail HostingServer' or by using a link whose display text and destination are both set to an email address (support@webmail.com)."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    any(html.xpath(body.html, '//h3').nodes,
 9        .inner_text == "Webmail HostingServer"
10    )
11    or (
12      any(body.links,
13          .display_url.url == "support@webmail.com"
14          and .href_url.url == "support@webmail.com"
15      )
16    )
17  )  
18attack_types:
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "Social engineering"
22detection_methods:
23  - "HTML analysis"
24  - "URL analysis"
25id: "d8218991-489e-51b4-8be9-991f627ce9a5"
to-top