High Severity

Attachment: RTF with link to free-hosted Cloudflare Pages

Labels

Credential Phishing
Free subdomain host
File analysis
URL analysis
HTML analysis
Sender analysis

Description

Detects inbound emails that contain an RTF attachment. The rule extracts embedded content from the RTF file and inspects any URLs found within it, following redirects and analyzing the final destination page's links. It flags cases where those links point to domains hosted on the free Cloudflare Pages service (pages.dev), a common tactic used to host malicious or deceptive content while evading detection.

References

No references.

Sublime Security
Created Aug 13th, 2026 • Last updated Aug 13th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(filter(attachments, .file_type == 'rtf'),
        any(file.explode(.),
            any(.scan.url.urls,
                any(ml.link_analysis(.).final_dom.links,
                    .href_url.domain.root_domain in ('pages.dev')
                )
            )
        )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started