Medium Severity

Link: Document-themed link to newly registered domain

Description

Detects inbound emails containing links whose display text mimics a document file (.xlsx, .xls, .pdf, .doc, .docx) but whose resolved destination domain was registered within the last 30 days, a strong indicator of a newly stood-up malicious infrastructure used to harvest credentials or deliver malware.

References

No references.

Sublime Security
Created Aug 18th, 2026 • Last updated Aug 18th, 2026
Source
type.inbound
and any(body.current_thread.links,
        strings.ends_with(.display_text,
                          '.xlsx',
                          '.xls',
                          '.pdf',
                          '.doc',
                          '.docx'
        )
        and network.whois(ml.link_analysis(., mode="aggressive").effective_url.domain
        ).days_old <= 30
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started