Link: Mismatched hyperlink with randomized domain via Foxmail

calendar Nov 3, 2026  ·
Share on: linkedin copy

Detects inbound messages sent using the Foxmail mail client that contain mismatched hyperlinks, where the displayed link text does not match the actual destination URL. The underlying domain and path consist of short, randomized alphanumeric strings often associated with phishing infrastructure or URL redirection services. Messages classified as advertising or promotional content by the NLU model are excluded to reduce false positives.

Sublime rule (View on GitHub)

 1name: "Link: Mismatched hyperlink with randomized domain via Foxmail"
 2description: "Detects inbound messages sent using the Foxmail mail client that contain mismatched hyperlinks, where the displayed link text does not match the actual destination URL. The underlying domain and path consist of short, randomized alphanumeric strings often associated with phishing infrastructure or URL redirection services. Messages classified as advertising or promotional content by the NLU model are excluded to reduce false positives."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .mismatched
 9          and regex.imatch(.href_url.domain.sld, '[a-z0-9]{4,7}')
10          and regex.match(.href_url.path, '/[A-Za-z0-9]{5,8}')
11  )
12  and strings.icontains(headers.mailer, 'foxmail')
13  and not any(ml.nlu_classifier(body.current_thread.text).topics,
14              .name == "Advertising and Promotions"
15  )  
16attack_types:
17  - "Credential Phishing"
18tactics_and_techniques:
19  - "Social engineering"
20  - "Evasion"
21detection_methods:
22  - "URL analysis"
23  - "Header analysis"
24  - "Natural Language Understanding"
25id: "4ac968bc-8a5a-5234-9ceb-a03c99811b6e"
to-top