Link: Hex-encoded recipient email in URL fragment

calendar Sep 16, 2026 · Attack surface reduction  ·
Share on: linkedin copy

Detects messages where a link in the body contains the recipient's email address hex-encoded in the URL fragment, a technique used to auto-populate or validate the target on a credential harvesting page. This pattern commonly appears in fake password expiration or account notice lures that direct victims to spoofed login pages pre-filled with their own address to increase credibility.

Sublime rule (View on GitHub)

 1name: "Link: Hex-encoded recipient email in URL fragment"
 2description: "Detects messages where a link in the body contains the recipient's email address hex-encoded in the URL fragment, a technique used to auto-populate or validate the target on a credential harvesting page. This pattern commonly appears in fake password expiration or account notice lures that direct victims to spoofed login pages pre-filled with their own address to increase credibility."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          strings.decode_hex(.href_url.fragment) == recipients.to[0].email.email
 9  )  
10tags:
11  - "Attack surface reduction"
12attack_types:
13  - "Credential Phishing"
14tactics_and_techniques:
15  - "Encryption"
16  - "Evasion"
17  - "Social engineering"
18detection_methods:
19  - "URL analysis"
20  - "Content analysis"
21id: "046ed6f2-4825-5b41-9410-630113920ba3"

Related rules

to-top