Link: URL using underscore-dot substitution in display text

calendar Aug 7, 2026  ·
Share on: linkedin copy

Detects inbound messages containing links where the display text starts with 'https://' and uses an underscore followed by 'com/' in place of a standard dot-com domain format (e.g., 'example_com/'). This technique is used to bypass display text URL parsing, as the malformed URL cannot be resolved by standard URL parsers.

Sublime rule (View on GitHub)

 1name: "Link: URL using underscore-dot substitution in display text"
 2description: "Detects inbound messages containing links where the display text starts with 'https://' and uses an underscore followed by 'com/' in place of a standard dot-com domain format (e.g., 'example_com/'). This technique is used to bypass display text URL parsing, as the malformed URL cannot be resolved by standard URL parsers."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          strings.starts_with(.display_text, 'https://')
 9          and strings.contains(.display_text, '_com/')
10          and not strings.contains(.display_text, '.com/')
11          and strings.parse_url(.display_text).url is null
12  )  
13attack_types:
14  - "Credential Phishing"
15tactics_and_techniques:
16  - "Evasion"
17  - "Social engineering"
18detection_methods:
19  - "URL analysis"
20  - "Content analysis"
21id: "802edfc6-5031-59bb-831b-16d0772b2b96"
to-top