Link: Newly registered domain in reference lure

calendar Sep 29, 2026  ·
Share on: linkedin copy

Detects inbound messages where the subject line contains the word 'reference' and at least one hyperlink in the body also displays 'reference' as its link text, while pointing to a domain that was registered fewer than 90 days ago. This combination of a common business lure term paired with a recently created destination domain is a strong indicator of malicious intent.

Sublime rule (View on GitHub)

 1name: "Link: Newly registered domain in reference lure"
 2description: "Detects inbound messages where the subject line contains the word 'reference' and at least one hyperlink in the body also displays 'reference' as its link text, while pointing to a domain that was registered fewer than 90 days ago. This combination of a common business lure term paired with a recently created destination domain is a strong indicator of malicious intent."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.icontains(subject.base, 'reference')
 8  and any(body.current_thread.links,
 9          strings.icontains(.display_text, 'reference')
10          and network.whois(.href_url.domain).days_old < 90
11  )  
12attack_types:
13  - "Credential Phishing"
14  - "BEC/Fraud"
15tactics_and_techniques:
16  - "Social engineering"
17detection_methods:
18  - "Content analysis"
19  - "URL analysis"
20  - "Whois"
21id: "2e07830b-8fee-5bbd-898e-136dee031fb1"
to-top