• Sublime Core Feed
Low Severity

Link: Base64 encoded recipient address in URL fragment with subject hash

Description

Detects messages containing an alphanumeric string that is between 32 and 64 characters in the subject line that corresponds to a URL fragment containing the recipient's email address encoded in base64. This technique is commonly used to personalize malicious links and evade detection by embedding the target's email address within the URL structure.

References

No references.

Sublime Security
Created Dec 11th, 2025 • Last updated Dec 11th, 2025
Source
type.inbound
and any(regex.iextract(subject.subject,
                       '[^a-z0-9](?P<string>[a-z0-9]{32,64})(?:$|[^a-z0-9])'
        ),
        any(body.links,
            strings.contains(.href_url.fragment, ..named_groups["string"])
            and any(strings.scan_base64(.href_url.fragment), strings.contains(., recipients.to[0].email.email))
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started