Medium Severity

Link: Hotel booking spoofed display URL

Labels

BEC/Fraud

Credential Phishing

Description

Detects messages containing links with hotel-related display URLs that either redirect to different domains or contain suspicious parameters commonly used in booking scams and fraudulent hotel reservation schemes.

References

No references.

Sublime Security

Created Feb 17th, 2026 • Last updated Feb 17th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(body.links,
        strings.icontains(.display_url.url, 'booking.com')
        and not strings.icontains(.href_url.url,
                                  .display_url.domain.root_domain
        )
        and .display_url.domain.root_domain != .href_url.domain.root_domain
        and (
          regex.icontains(.display_url.url,
                          '(?:aid=\d{6}|label=gen\d+nr|review-bad|\b\w+\.html|expirince|hoteladmin|feedback)'
          )
          or .href_url.domain.root_domain == "share.google"
          or any(body.links, network.whois(.href_url.domain).days_old < 30)
        )
        and .mismatched
)
and not strings.icontains(body.current_thread.text,
                          "unsubscribe from this list"
)
and not (
  sender.email.domain.root_domain == "booking.com"
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.