Link: Compromised WordPress site redirecting to suspicious root domain

calendar Jul 27, 2026  ·
Share on: linkedin copy

Inbound messages contain links routing through compromised WordPress installations (matching paths such as /wp-admin, /wp-includes, or /wp-content) that ultimately redirect to the root of an unrelated domain with no query parameters. The lure theme across observed samples centers on urgency around agreement review, document signing, and fund/profit notifications — designed to pressure recipients into clicking. The redirect pattern, combined with WordPress path indicators, suggests adversaries are abusing vulnerable WordPress sites as an intermediary hop to obscure the true destination.

Sublime rule (View on GitHub)

 1name: "Link: Compromised WordPress site redirecting to suspicious root domain"
 2description: "Inbound messages contain links routing through compromised WordPress installations (matching paths such as /wp-admin, /wp-includes, or /wp-content) that ultimately redirect to the root of an unrelated domain with no query parameters. The lure theme across observed samples centers on urgency around agreement review, document signing, and fund/profit notifications — designed to pressure recipients into clicking. The redirect pattern, combined with WordPress path indicators, suggests adversaries are abusing vulnerable WordPress sites as an intermediary hop to obscure the true destination."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(filter(body.current_thread.links,
 8                 regex.icontains(.href_url.path,
 9                                 '^\/wp-(?:admin|includes|content)'
10                 )
11                 // remove "the newsletter plugin" encoded URLs
12                 and not (
13                   .href_url.path == "/wp-admin/admin-ajax.php"
14                   and .href_url.query_params_decoded["action"][0] == "tnptr"
15                   and 'nltr' in keys(.href_url.query_params_decoded)
16                 )
17          ),
18          // redirected to a page that is a "root" page
19          any(ml.link_analysis(.).redirect_history,
20              .path == "/"
21              and .domain.root_domain != ..href_url.domain.root_domain
22              // no query_params
23              and (.query_params == "" or .query_params is null)
24              and (.domain.subdomain is null or .domain.subdomain == "www")
25          )
26  )  
27attack_types:
28  - "Credential Phishing"
29  - "BEC/Fraud"
30tactics_and_techniques:
31  - "Open redirect"
32  - "Evasion"
33  - "Social engineering"
34detection_methods:
35  - "URL analysis"
36  - "Content analysis"
37id: "000b77ad-5a28-55b9-b436-4e02524f7eb5"
to-top