Medium Severity

Link: RTL text reversal with recipient email in URL

Description

Flags inbound messages containing anchor tags styled with 'direction:rtl' to visually reverse displayed text—an evasion tactic against text-based scanning—where the underlying link URL also contains the recipient's email address, a common personalization technique used to track or validate targets in phishing links.

References

No references.

Sublime Security
Created Aug 20th, 2026 • Last updated Aug 20th, 2026
Source
type.inbound
and recipients.to[0].email.domain.valid
and any(html.xpath(body.html, '//a').nodes,
        strings.icontains(.raw, 'direction:rtl')
        and any(.links,
                strings.contains(.href_url.url, recipients.to[0].email.email)
                // exclude common RTL languages
                and not regex.icontains(.display_text,
                                        '[\x{0590}-\x{08FF}\x{FB1D}-\x{FDFF}\x{FE70}-\x{FEFF}]'
                )
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started