Service abuse: Lovable-hosted redirect to external phishing page

calendar Oct 6, 2026  ·
Share on: linkedin copy

Detects inbound emails containing links to Lovable-hosted sites (lovable.app published sites or lovableproject.com preview/sandbox builds) whose rendered page contains links pointing to external domains or raw IP addresses, paired with lure text urging the recipient to view, open, access, or download documents, invoices, payments, voicemail, or similar sensitive items. This pattern indicates abuse of the Lovable platform to host an intermediary page that redirects victims to a separate credential phishing or malicious destination.

Sublime rule (View on GitHub)

 1name: "Service abuse: Lovable-hosted redirect to external phishing page"
 2description: "Detects inbound emails containing links to Lovable-hosted sites (lovable.app published sites or lovableproject.com preview/sandbox builds) whose rendered page contains links pointing to external domains or raw IP addresses, paired with lure text urging the recipient to view, open, access, or download documents, invoices, payments, voicemail, or similar sensitive items. This pattern indicates abuse of the Lovable platform to host an intermediary page that redirects victims to a separate credential phishing or malicious destination."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(body.links,
 8                 .href_url.domain.root_domain in (
 9                   "lovable.app", // published sites
10                   "lovableproject.com" // preview/sandbox builds
11                 )
12          ),
13          any(filter(ml.link_analysis(.).final_dom.links,
14                     .href_url.ip.ip is not null
15                     or .href_url.domain.root_domain not in (
16                       "lovable.app",
17                       "lovable.dev",
18                       "lovableproject.com"
19                     )
20              ),
21              regex.icontains(.display_text,
22                              '(?s)^\s*(?:(?:view|open|access|download|review|go to|sign in)\b.{0,40}\b(?:documents?|files?|pdf|attachments?|messages?|voicemail|projects?|bids?|proposal|plans|receipt|statement|invoice|payment|billing|claim|package|invitation|agreement|contract|capital call)|listen\b)'
23              )
24          )
25  )  
26attack_types:
27  - "Credential Phishing"
28tactics_and_techniques:
29  - "Social engineering"
30  - "Open redirect"
31  - "Free subdomain host"
32detection_methods:
33  - "URL analysis"
34  - "HTML analysis"
35  - "Content analysis"
36id: "19f3df76-25a4-5092-9c9c-6425289c7dd2"
to-top