Link: Delimited encoded path parameters (~V~ scheme)

calendar Aug 31, 2026  ·
Share on: linkedin copy

This rule flags inbound messages containing a link with a repeating encoded pattern in the URL path, a technique used to obfuscate the true destination and evade static URL matching. The captured samples span a range of unrelated senders and lures - fake system/data access suspension notices, payment authorization failures, case submission confirmations, and backup storage reminders - all designed to create urgency and drive recipients to click through disguised links. The variety of spoofed sending domains and generic account/security themes suggests a shared link-obfuscation infrastructure being reused across many opportunistic lures rather than a single brand or campaign.

Sublime rule (View on GitHub)

 1name: "Link: Delimited encoded path parameters (~V~ scheme)"
 2description: "This rule flags inbound messages containing a link with a repeating encoded pattern in the URL path, a technique used to obfuscate the true destination and evade static URL matching. The captured samples span a range of unrelated senders and lures - fake system/data access suspension notices, payment authorization failures, case submission confirmations, and backup storage reminders - all designed to create urgency and drive recipients to click through disguised links. The variety of spoofed sending domains and generic account/security themes suggests a shared link-obfuscation infrastructure being reused across many opportunistic lures rather than a single brand or campaign."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(body.links, regex.count(.href_url.path, '(?:~V~[NPQRSfhjlm]+)') >= 3)  
 8attack_types:
 9  - "Credential Phishing"
10  - "Spam"
11tactics_and_techniques:
12  - "Evasion"
13  - "Social engineering"
14  - "Spoofing"
15detection_methods:
16  - "URL analysis"
17  - "Content analysis"
18id: "c5f4af12-9328-5d83-9a6d-c2ea569ab709"
to-top