Open redirect: Recipient address embedded in redirect URL pointing to newly registered domain

calendar Jul 24, 2026  ·
Share on: linkedin copy

Detects inbound messages sent to a single recipient where the body contains a link that embeds the recipient's email address in a URL query parameter, and the resolved destination domain was registered less than 100 days ago. This pattern is consistent with personalized redirect links designed to evade detection while directing targets to newly established infrastructure.

Sublime rule (View on GitHub)

 1name: "Open redirect: Recipient address embedded in redirect URL pointing to newly registered domain"
 2description: "Detects inbound messages sent to a single recipient where the body contains a link that embeds the recipient's email address in a URL query parameter, and the resolved destination domain was registered less than 100 days ago. This pattern is consistent with personalized redirect links designed to evade detection while directing targets to newly established infrastructure."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(recipients.to) == 1
 8  and any(body.current_thread.links,
 9          strings.contains(.href_url.url, recipients.to[0].email.email)
10          and length(.href_url.query_params_decoded['url']) > 0
11          and any(.href_url.query_params_decoded['url'],
12                  strings.contains(strings.parse_url(.).url,
13                                   recipients.to[0].email.email
14                  )
15                  and network.whois(strings.parse_url(.).domain).days_old < 100
16          )
17  )  
18attack_types:
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "Open redirect"
22  - "Social engineering"
23detection_methods:
24  - "URL analysis"
25  - "Whois"
26id: "861400d2-930a-5484-afa6-3dfa850dfec2"
to-top