Service abuse: EventCreate links to newly registered domains

calendar Aug 31, 2026  ·
Share on: linkedin copy

Flags inbound messages containing links to eventcreate.com where the final rendered page includes outbound links to domains registered within the last 30 days, indicating the use of a legitimate service to pivot traffic to freshly created phishing infrastructure.

Sublime rule (View on GitHub)

 1name: "Service abuse: EventCreate links to newly registered domains"
 2description: "Flags inbound messages containing links to eventcreate.com where the final rendered page includes outbound links to domains registered within the last 30 days, indicating the use of a legitimate service to pivot traffic to freshly created phishing infrastructure."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(body.current_thread.links,
 8                 .href_url.domain.root_domain == 'eventcreate.com'
 9          ),
10          any(ml.link_analysis(.).final_dom.links,
11              network.whois(.href_url.domain).days_old < 30
12          )
13          or ml.link_analysis(.).credphish.disposition == "phishing"
14  )  
15attack_types:
16  - "Credential Phishing"
17tactics_and_techniques:
18  - "Out of band pivot"
19detection_methods:
20  - "URL analysis"
21  - "Whois"
22  - "HTML analysis"
23id: "4800b169-b40b-5664-b763-98f21661ba46"
to-top