Link: Gmail phishkit with suspicious recipient

calendar Sep 2, 2026  ·
Share on: linkedin copy

Detects inbound messages where the recipient field is suspicious: the sender and recipient email addresses match, the recipient domain is invalid, or there are no valid recipients across to/cc/bcc fields. The rule further inspects the final rendered DOM of contained links using aggressive link analysis, flagging cases where the page impersonates Gmail's login flow by referencing an encoded 'gmail.com' string alongside the specific '/gmail/js/start.js' script path, a known indicator of a Gmail credential phishing kit.

Sublime rule (View on GitHub)

 1name: "Link: Gmail phishkit with suspicious recipient"
 2description: "Detects inbound messages where the recipient field is suspicious: the sender and recipient email addresses match, the recipient domain is invalid, or there are no valid recipients across to/cc/bcc fields. The rule further inspects the final rendered DOM of contained links using aggressive link analysis, flagging cases where the page impersonates Gmail's login flow by referencing an encoded 'gmail.com' string alongside the specific '/gmail/js/start.js' script path, a known indicator of a Gmail credential phishing kit."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // Suspicious recipient
 8  and (
 9    (
10      length(recipients.to) == 1
11      and (
12        sender.email.email == recipients.to[0].email.email
13        or recipients.to[0].email.domain.valid == false
14      )
15    )
16    or (
17      (
18        length(recipients.to) == 0
19        or all(recipients.to, .email.domain.valid == false)
20      )
21      and length(recipients.cc) == 0
22      and length(recipients.bcc) == 0
23    )
24  )
25  and 0 < length(body.current_thread.links) < 10
26  and any(body.current_thread.links,
27          strings.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
28                            "aHR0cHM6Ly9nbWFpbC5jb20=" // https://gmail.com
29          )
30          and strings.icontains(ml.link_analysis(., mode="aggressive").final_dom.raw,
31                                "/gmail/js/start.js"
32          )
33  )  
34attack_types:
35  - "Credential Phishing"
36tactics_and_techniques:
37  - "Impersonation: Brand"
38  - "Evasion"
39  - "Social engineering"
40detection_methods:
41  - "URL analysis"
42  - "HTML analysis"
43  - "Sender analysis"
44id: "39f3a5f3-e815-585d-bc31-9ca34c95f2c0"
to-top