Link: Personalized URL with recipient address on commonly abused web service
Link: Personal SharePoint with invalid recipients and credential theft language
Link: QR code with phishing disposition in img or pdf
Link: QR Code with suspicious language (untrusted sender)
Link: QuickBooks image lure with suspicious link
Link: Recently registered .vu domain in lure
Link: Recipient email address in 'eta' parameter
Link: Remittance payment request with timeline template
Link: RFI document reference pattern in display text
Link: Romance/Sexual Language With Suspicious Link
Link: RTL text reversal with recipient email in URL
Link: ScreenConnect installer with suspicious relay domain
Link: ScreenConnect remote access tool delivery with unattended guest access
Link: Scribd fullscreen link from suspicious sender
Link: Self-sender credential theft with configuration placeholder
Link: Self-sender with IP geolocation check and suspicious link behavior
Link: Self-sender with sender org in subject and credential theft indicator
Link: Self-sent message with quarterly document review request
Link: Self-sent PDF lure with subject correlation
Link: SharePoint filename matches org name
Link: Shortened URL with fragment matching subject
Link: Single character path with credential theft body and self sender behavior or invalid recipient
Link: Squarespace infrastructure abuse
Link: .su domain link redirection from new sender domains
Link: Suspicious Family fragment parameter with encoded recipient data
Link: Suspicious file retrieval with recipient targeting
Link: Suspicious go.php redirect with document lure
Link: Suspicious HTML structure with subject mirrored in body and single link
Link: Suspicious Loom HTML file path
Link: Suspicious recipient with timeout redirect
Link: Suspicious single-domain link with suspicious path and financial lure indicators
Link: Suspicious URL with recipient targeting and special characters
Link: Suspicious wp-admin path from mismatched sender domain
Link: Tax document lure Portuguese/Spanish with suspicious domains
Link: Telegraph-hosted content
Link to auto-downloaded disk image in encrypted zip
Link to auto-downloaded DMG in encrypted zip
Link to auto-downloaded file with Adobe branding
Link to auto-downloaded file with Google Drive branding
Link to auto-download of a suspicious file type (unsolicited)
Link to Google Apps Script macro (unsolicited)
Link to Google Apps Script macro via comment tagging
Link: Uncommon SharePoint document type with sender's display name
Link: Unformatted template with literal placeholder in mailto link
Link: Unicode character obfuscation in display name with base64-encoded URL fragment
Link: Unsolicited email contains link leading to Tycoon URL structure
Link: Unsolicited email contains link to page containing Tycoon URI structure
Link: URL fragmented by hidden spans
Link: URL scheme obfuscation via split HTML anchors
Link: URL shortener chaining to workers.dev redirect