Service abuse: Self-service platform page with bid or proposal lure text linking to newly registered domain

calendar Oct 29, 2026  ·
Share on: linkedin copy

Detects inbound emails containing links to self-service website creation platforms where the rendered page links to a domain registered within the last 30 days. The linked anchor text uses bid, proposal, or tender-related language such as 'review bid' or 'open proposal', a pattern commonly used to lure victims into engaging with fraudulent procurement or tender schemes.

Sublime rule (View on GitHub)

 1name: "Service abuse: Self-service platform page with bid or proposal lure text linking to newly registered domain"
 2description: "Detects inbound emails containing links to self-service website creation platforms where the rendered page links to a domain registered within the last 30 days. The linked anchor text uses bid, proposal, or tender-related language such as 'review bid' or 'open proposal', a pattern commonly used to lure victims into engaging with fraudulent procurement or tender schemes."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .href_url.domain.root_domain in $self_service_creation_platform_domains
 9          and any(ml.link_analysis(.).final_dom.links,
10                  network.whois(.href_url.domain).days_old < 30
11                  and regex.icontains(.display_text,
12                                      '(?:review|view|open|access|download|bid)\W+(?:bid|proposal|document|rfp|rfq|tender)'
13                  )
14          )
15  )  
16attack_types:
17  - "BEC/Fraud"
18  - "Credential Phishing"
19tactics_and_techniques:
20  - "Social engineering"
21  - "Lookalike domain"
22detection_methods:
23  - "URL analysis"
24  - "HTML analysis"
25  - "Whois"
26  - "Content analysis"
27id: "198aff8f-9419-58e1-872b-fb1c4bf11537"
to-top