Link: Newly registered suspicious domain with single-character HTML filename

calendar Sep 25, 2026  ·
Share on: linkedin copy

Detects inbound emails containing links where the URL path ends in a single-character HTML filename, the domain uses a suspicious top-level domain, and the domain was registered fewer than 30 days ago. This combination of indicators is commonly associated with rapidly deployed phishing kits hosted on freshly registered infrastructure.

Sublime rule (View on GitHub)

 1name: "Link: Newly registered suspicious domain with single-character HTML filename"
 2description: "Detects inbound emails containing links where the URL path ends in a single-character HTML filename, the domain uses a suspicious top-level domain, and the domain was registered fewer than 30 days ago. This combination of indicators is commonly associated with rapidly deployed phishing kits hosted on freshly registered infrastructure."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          regex.icontains(.href_url.path, '/[^/]\.html')
 9          and .href_url.domain.tld in $suspicious_tlds
10          and network.whois(.href_url.domain).days_old < 30
11  )  
12attack_types:
13  - "Credential Phishing"
14tactics_and_techniques:
15  - "Evasion"
16  - "Social engineering"
17detection_methods:
18  - "URL analysis"
19  - "Whois"
20id: "50176976-44a1-5b97-9aa8-3c7cffcc0fd0"
to-top