Medium Severity

Link: Double base64-encoded URL path

Labels

Description

Flags inbound messages containing two or more links whose URL paths contain long base64-encoded strings that, when decoded, reveal additional base64-like content. This double-encoding pattern is used to obscure the true destination of a link and evade automated URL inspection. Senders from highly trusted root domains that pass DMARC authentication are excluded.

References

No references.

Sublime Security

Created Aug 24th, 2026 • Last updated Aug 24th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and 2 <= length(filter(body.links,
                       regex.imatch(.href_url.path, '/[a-zA-Z0-9+/]{80,}={0,2}')
                       and regex.imatch(strings.decode_base64(regex.extract(.href_url.path,
                                                                            '/(?P<b>[a-zA-Z0-9+/]{80,}={0,2})'
                                                              )[0].named_groups["b"]
                                        ),
                                        '[a-zA-Z0-9+/]{60,}={0,2}'
                       )
                )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.