Low Severity

Evasion: Suspicious TLD link redirecting to Wikipedia

Labels

Credential Phishing
Spam
Evasion
Open redirect
URL analysis

Description

Flags inbound messages containing links with domains registered under suspicious top-level domains that redirect to Wikipedia when analyzed. This behavior indicates the link is detecting automated sandbox or security analysis tools and serving benign content to evade detection, while likely delivering malicious content to real users.

References

No references.

Sublime Security
Created Aug 21st, 2026 • Last updated Aug 21st, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(body.current_thread.links,
        .href_url.domain.tld in $suspicious_tlds
        and ml.link_analysis(.).effective_url.url in (
          'https://www.wikipedia.org/'
        )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started