Link: Observed URL path (lht) with recipient email address

calendar Oct 6, 2026  ·
Share on: linkedin copy

This rule flags inbound messages where a link in the body contains the recipient's own email address appended to the URL path (e.g. after '/&lht='), a technique used to personalize or validate tracking links. The matched samples consistently use a fake missed voicecall/voicemail notification lure with obfuscated, zero-width characters in the subject line and spoofed sender domains, directing recipients to a credential-harvesting page tailored to their address.

Sublime rule (View on GitHub)

 1name: "Link: Observed URL path (lht) with recipient email address"
 2description: "This rule flags inbound messages where a link in the body contains the recipient's own email address appended to the URL path (e.g. after '/&lht='), a technique used to personalize or validate tracking links. The matched samples consistently use a fake missed voicecall/voicemail notification lure with obfuscated, zero-width characters in the subject line and spoofed sender domains, directing recipients to a credential-harvesting page tailored to their address."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and recipients.to[0].email.domain.valid
 8  and any(body.links,
 9          strings.iends_with(.href_url.path,
10                             strings.concat('/&lht=',
11                                            recipients.to[0].email.email
12                             )
13          )
14  )  
15attack_types:
16  - "Credential Phishing"
17tactics_and_techniques:
18  - "Social engineering"
19  - "Impersonation: Brand"
20  - "Evasion"
21  - "Spoofing"
22detection_methods:
23  - "URL analysis"
24  - "Content analysis"
25  - "Header analysis"
26id: "0fc98e55-e933-51da-9d37-cb5bc3bfcb8d"
to-top