Medium Severity

Link: Shortened URL with fragment matching subject

Description

Detects messages containing shortened links where the URL fragment appears in the email subject line, indicating potential targeted link tracking or social engineering tactics.

References

No references.

Sublime Security
Created Apr 7th, 2026 • Last updated Apr 9th, 2026
Source
type.inbound
and any(body.current_thread.links,
        .href_url.domain.root_domain in $url_shorteners
        and .href_url.fragment is not null
        and length(.href_url.fragment) > 5
        and strings.contains(subject.subject, .href_url.fragment)
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started