Medium Severity

Link: Newly registered domain in reference lure

Labels

Credential Phishing
BEC/Fraud
Social engineering
Content analysis
URL analysis
Whois

Description

Detects inbound messages where the subject line contains the word 'reference' and at least one hyperlink in the body also displays 'reference' as its link text, while pointing to a domain that was registered fewer than 90 days ago. This combination of a common business lure term paired with a recently created destination domain is a strong indicator of malicious intent.

References

No references.

Sublime Security
Created Sep 29th, 2026 • Last updated Sep 29th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and strings.icontains(subject.base, 'reference')
and any(body.current_thread.links,
        strings.icontains(.display_text, 'reference')
        and network.whois(.href_url.domain).days_old < 90
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started