Link: .su domain link redirection from new sender domains

calendar Aug 13, 2026  ·
Share on: linkedin copy

Catches inbound messages from recently established sending domains where a link in the body ultimately redirects through a .su (Soviet Union) top-level domain, despite the visible link pointing elsewhere. These messages often masquerade as academic transcript requests, invitations, or administrative notices, using legitimate-looking business or organizational senders to deliver links that funnel recipients through .su-based redirect infrastructure, a technique commonly used to obscure the final malicious destination.

Sublime rule (View on GitHub)

 1name: "Link: .su domain link redirection from new sender domains"
 2description: "Catches inbound messages from recently established sending domains where a link in the body ultimately redirects through a .su (Soviet Union) top-level domain, despite the visible link pointing elsewhere. These messages often masquerade as academic transcript requests, invitations, or administrative notices, using legitimate-looking business or organizational senders to deliver links that funnel recipients through .su-based redirect infrastructure, a technique commonly used to obscure the final malicious destination."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and profile.by_sender_email().days_known < 7
 8  and any(body.links,
 9          .href_url.domain.tld != "su"
10          and any(ml.link_analysis(.).redirect_history, .domain.tld == "su")
11  )  
12attack_types:
13  - "Credential Phishing"
14  - "Spam"
15tactics_and_techniques:
16  - "Open redirect"
17  - "Social engineering"
18  - "Evasion"
19detection_methods:
20  - "URL analysis"
21  - "Sender analysis"
22id: "8c0d84f6-bb81-5c6d-9dec-1124c326a109"
to-top