Link: Recipient email address in 'eta' parameter
Link: Remittance payment request with timeline template
Link: RFI document reference pattern in display text
Link: Romance/Sexual Language With Suspicious Link
Link: ScreenConnect installer with suspicious relay domain
Link: ScreenConnect remote access tool delivery with unattended guest access
Link: Scribd fullscreen link from suspicious sender
Link: Self-sender credential theft with configuration placeholder
Link: Self-sender with IP geolocation check and suspicious link behavior
Link: Self-sender with sender org in subject and credential theft indicator
Link: Self-sent message with quarterly document review request
Link: Self-sent PDF lure with subject correlation
Link: SharePoint filename matches org name
Link: Shortened URL with fragment matching subject
Link: Single character path with credential theft body and self sender behavior or invalid recipient
Link: Squarespace infrastructure abuse
Link: Suspicious Family fragment parameter with encoded recipient data
Link: Suspicious file retrieval with recipient targeting
Link: Suspicious go.php redirect with document lure
Link: Suspicious Loom HTML file path
Link: Suspicious single-domain link with suspicious path and financial lure indicators
Link: Suspicious URL with recipient targeting and special characters
Link: Suspicious wp-admin path from mismatched sender domain
Link: Tax document lure Portuguese/Spanish with suspicious domains
Link to auto-downloaded disk image in encrypted zip
Link to auto-downloaded DMG in encrypted zip
Link to auto-downloaded file with Adobe branding
Link to auto-downloaded file with Google Drive branding
Link to auto-download of a suspicious file type (unsolicited)
Link to Google Apps Script macro (unsolicited)
Link to Google Apps Script macro via comment tagging
Link: Uncommon SharePoint document type with sender's display name
Link: Unformatted template with literal placeholder in mailto link
Link: Unsolicited email contains link leading to Tycoon URL structure
Link: Unsolicited email contains link to page containing Tycoon URI structure
Link: URL scheme obfuscation via split HTML anchors
Link: URL shortener with copy-paste instructions and credential theft language
Link: WordPress admin targeting with recipient identifier in URL parts
Link: WordPress login page with Blogspot Binance scam
Lookalike sender domain (untrusted sender)
Low reputation link to auto-downloaded HTML file with smuggling indicators
macOS malware: Compiled AppleScript with document double-extension
Mass campaign: Cross Site Scripting (XSS) attempt
Mass campaign: recipient address in subject, body, and link (untrusted sender)
Message content: Request for author engagement
Microsoft device code phishing
Microsoft infrastructure abuse with suspicious patterns
Mismatched links: Free file share with urgent language
Newly registered sender or reply-to domain with newly registered linked domain
Non-RFC compliant calendar files from unsolicited sender