High Severity

Link: Compromised WordPress site redirecting to suspicious root domain

Labels

Credential Phishing

BEC/Fraud

Description

Inbound messages contain links routing through compromised WordPress installations (matching paths such as /wp-admin, /wp-includes, or /wp-content) that ultimately redirect to the root of an unrelated domain with no query parameters. The lure theme across observed samples centers on urgency around agreement review, document signing, and fund/profit notifications — designed to pressure recipients into clicking. The redirect pattern, combined with WordPress path indicators, suggests adversaries are abusing vulnerable WordPress sites as an intermediary hop to obscure the true destination.

References

No references.

Sublime Security

Created Jul 27th, 2026 • Last updated Jul 27th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(filter(body.current_thread.links,
               regex.icontains(.href_url.path,
                               '^\/wp-(?:admin|includes|content)'
               )
               // remove "the newsletter plugin" encoded URLs
               and not (
                 .href_url.path == "/wp-admin/admin-ajax.php"
                 and .href_url.query_params_decoded["action"][0] == "tnptr"
                 and 'nltr' in keys(.href_url.query_params_decoded)
               )
        ),
        // redirected to a page that is a "root" page
        any(ml.link_analysis(.).redirect_history,
            .path == "/"
            and .domain.root_domain != ..href_url.domain.root_domain
            // no query_params
            and (.query_params == "" or .query_params is null)
            and (.domain.subdomain is null or .domain.subdomain == "www")
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.