Link: Invalid reply-to with recipient details in subject, body, and encoded link

calendar Jul 16, 2026  ·
Share on: linkedin copy

Detects inbound messages with an invalid reply-to address where the recipient's domain SLD appears in the subject, the recipient's local part and domain SLD appear in the body, and the recipient's full email address is base64-encoded within a link fragment.

Sublime rule (View on GitHub)

 1name: "Link: Invalid reply-to with recipient details in subject, body, and encoded link"
 2description: "Detects inbound messages with an invalid reply-to address where the recipient's domain SLD appears in the subject, the recipient's local part and domain SLD appear in the body, and the recipient's full email address is base64-encoded within a link fragment."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // Invalid reply-to address
 8  and any(headers.reply_to, not .email.domain.valid)
 9  and strings.icontains(subject.base, recipients.to[0].email.domain.sld)
10  and strings.icontains(body.current_thread.text,
11                        recipients.to[0].email.local_part
12  )
13  and strings.icontains(body.current_thread.text,
14                        recipients.to[0].email.domain.sld
15  )
16  and any(body.current_thread.links,
17          any(strings.scan_base64(.href_url.fragment),
18              . == recipients.to[0].email.email
19          )
20  )  
21attack_types:
22  - "Credential Phishing"
23  - "BEC/Fraud"
24tactics_and_techniques:
25  - "Social engineering"
26  - "Evasion"
27  - "Spoofing"
28detection_methods:
29  - "Header analysis"
30  - "Content analysis"
31  - "URL analysis"
32  - "Sender analysis"
33id: "aebbc685-7cbf-56ee-ae32-1a49ddd9dcd6"
to-top