Link: Self-sender with IP geolocation check and suspicious link behavior

calendar Jul 14, 2026  ·
Share on: linkedin copy

Detects messages where the sender and recipient are the same address that access IP geolocation services (ipinfo.io) and exhibit suspicious behavior, such as randomization scripting or confirmed credential harvesting indicators.

Sublime rule (View on GitHub)

 1name: "Link: Self-sender with IP geolocation check and suspicious link behavior"
 2description: "Detects messages where the sender and recipient are the same address that access IP geolocation services (ipinfo.io) and exhibit suspicious behavior, such as randomization scripting or confirmed credential harvesting indicators."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // self sender
 8  and (
 9    length(recipients.to) == 1
10    and recipients.to[0].email.email == sender.email.email
11  )
12  and 0 < length(body.current_thread.links) < 10
13  and any(filter(body.current_thread.links,
14                 .href_url.domain.root_domain != sender.email.domain.root_domain
15          ),
16          any(ml.link_analysis(.).unique_urls_accessed,
17              .url == 'https://ipinfo.io/json'
18          )
19  )
20  and not headers.return_path.domain.root_domain == "salesforce.com"  
21attack_types:
22  - "Credential Phishing"
23tactics_and_techniques:
24  - "Evasion"
25  - "Social engineering"
26detection_methods:
27  - "Sender analysis"
28  - "URL analysis"
29id: "fa708c3c-c40f-5b0d-b9c4-e9512fb32629"
to-top