Link: Suspicious recipient with sender SLD as subject and free host link

calendar Oct 28, 2026  ·
Share on: linkedin copy

Detects inbound emails where the subject line consists solely of the sender's domain SLD, combined with signs of self-addressing or invalid/missing recipients (such as sender and recipient sharing the same email or local part, invalid recipient domains, or no CC/BCC recipients). The rule also requires that the email body contains links pointing to known free file hosting or free subdomain hosting services, a pattern often used to disguise malicious links as legitimate self-sent notifications.

Sublime rule (View on GitHub)

 1name: "Link: Suspicious recipient with sender SLD as subject and free host link"
 2description: "Detects inbound emails where the subject line consists solely of the sender's domain SLD, combined with signs of self-addressing or invalid/missing recipients (such as sender and recipient sharing the same email or local part, invalid recipient domains, or no CC/BCC recipients). The rule also requires that the email body contains links pointing to known free file hosting or free subdomain hosting services, a pattern often used to disguise malicious links as legitimate self-sent notifications."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // mention this in the rule name: subject is just the senders domain sld
 8  and subject.base =~ sender.email.domain.sld
 9  and (
10    // self sender or invaild recipent domain or local parts match
11    (
12      length(recipients.to) == 1
13      and (
14        sender.email.email == recipients.to[0].email.email
15        or recipients.to[0].email.domain.valid == false
16        or sender.email.local_part == recipients.to[0].email.local_part
17      )
18    )
19    // no recipients defined
20    or (
21      (
22        length(recipients.to) == 0
23        or all(recipients.to, .email.domain.valid == false)
24      )
25      and length(recipients.cc) == 0
26      and length(recipients.bcc) == 0
27    )
28  )
29  and any(body.current_thread.links,
30          .href_url.domain.root_domain in $free_file_hosts
31          or .href_url.domain.root_domain in $free_subdomain_hosts
32  )  
33attack_types:
34  - "Credential Phishing"
35tactics_and_techniques:
36  - "Free file host"
37  - "Free subdomain host"
38detection_methods:
39  - "URL analysis"
40  - "Header analysis"
41  - "Sender analysis"
42  - "Content analysis"
43id: "b8b71dbd-9f42-5382-9433-b4897a0b3011"
to-top