Link: RTL text reversal with recipient email in URL

calendar Aug 20, 2026  ·
Share on: linkedin copy

Flags inbound messages containing anchor tags styled with 'direction:rtl' to visually reverse displayed text—an evasion tactic against text-based scanning—where the underlying link URL also contains the recipient's email address, a common personalization technique used to track or validate targets in phishing links.

Sublime rule (View on GitHub)

 1name: "Link: RTL text reversal with recipient email in URL"
 2description: "Flags inbound messages containing anchor tags styled with 'direction:rtl' to visually reverse displayed text—an evasion tactic against text-based scanning—where the underlying link URL also contains the recipient's email address, a common personalization technique used to track or validate targets in phishing links."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and recipients.to[0].email.domain.valid
 8  and any(html.xpath(body.html, '//a').nodes,
 9          strings.icontains(.raw, 'direction:rtl')
10          and any(.links,
11                  strings.contains(.href_url.url, recipients.to[0].email.email)
12                  // exclude common RTL languages
13                  and not regex.icontains(.display_text,
14                                          '[\x{0590}-\x{08FF}\x{FB1D}-\x{FDFF}\x{FE70}-\x{FEFF}]'
15                  )
16          )
17  )  
18attack_types:
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "Evasion"
22  - "Social engineering"
23detection_methods:
24  - "HTML analysis"
25  - "URL analysis"
26id: "dbf5de4c-e105-5ca8-aa28-429fbdb61df4"
to-top