Service abuse: Webex notifications linking to suspicious domains

calendar Nov 13, 2026  ·
Share on: linkedin copy

Detects inbound messages sent from legitimate webex.com infrastructure where links embedded in the body point to newly registered domains, known URL shorteners, or open-redirect chains instead of trusted Webex/Cisco properties. Observed lures include fake TikTok Business Account security alerts and bogus advertising partnership terms updates, leveraging Webex's trusted sending reputation to deliver credential phishing links.

Sublime rule (View on GitHub)

 1name: "Service abuse: Webex notifications linking to suspicious domains"
 2description: "Detects inbound messages sent from legitimate webex.com infrastructure where links embedded in the body point to newly registered domains, known URL shorteners, or open-redirect chains instead of trusted Webex/Cisco properties. Observed lures include fake TikTok Business Account security alerts and bogus advertising partnership terms updates, leveraging Webex's trusted sending reputation to deliver credential phishing links."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain == "webex.com"
 8  and any(body.current_thread.links,
 9          .href_url.domain.root_domain not in (
10            "webex.com",
11            "cisco.com",
12            "ciscospark.com",
13            "wbx2.com",
14            "webexcontent.com"
15          )
16          and (
17            .href_url.domain.domain in $url_shorteners
18            or .href_url.domain.root_domain in $url_shorteners
19            or network.whois(.href_url.domain).days_old < 90
20            or any(.href_url.rewrite.encoders,
21                   strings.icontains(., "open_redirect")
22            )
23          )
24  )  
25attack_types:
26  - "Credential Phishing"
27tactics_and_techniques:
28  - "Impersonation: Brand"
29  - "Open redirect"
30  - "Social engineering"
31detection_methods:
32  - "URL analysis"
33  - "Whois"
34  - "Content analysis"
35  - "Sender analysis"
36id: "9c4e066b-81ee-51c2-b99a-074d15d86353"
to-top