Service abuse: Self-service platform redirecting to newly registered suspicious domain

calendar Sep 10, 2026 · Attack surface reduction  ·
Share on: linkedin copy

Detects inbound emails containing links to self-service creation platforms that ultimately redirect to newly registered domains (less than 30 days old) using suspicious top-level domains, indicating potential abuse of legitimate services.

Sublime rule (View on GitHub)

 1name: "Service abuse: Self-service platform redirecting to newly registered suspicious domain"
 2description: "Detects inbound emails containing links to self-service creation platforms that ultimately redirect to newly registered domains (less than 30 days old) using suspicious top-level domains, indicating potential abuse of legitimate services."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .href_url.domain.root_domain in $self_service_creation_platform_domains
 9          and any(ml.link_analysis(.).final_dom.links,
10                  network.whois(.href_url.domain).days_old < 30
11                  and .href_url.domain.tld in $suspicious_tlds
12          )
13  )  
14tags:
15  - "Attack surface reduction" 
16attack_types:
17  - "Credential Phishing"
18tactics_and_techniques:
19  - "Out of band pivot"
20  - "Evasion"
21detection_methods:
22  - "URL analysis"
23  - "Whois"
24  - "HTML analysis"
25id: "c4c38bbe-9d77-5040-9e78-92f2d50b3806"

Related rules

to-top