High Severity

Link: .su domain link redirection from new sender domains

Description

Catches inbound messages from recently established sending domains where a link in the body ultimately redirects through a .su (Soviet Union) top-level domain, despite the visible link pointing elsewhere. These messages often masquerade as academic transcript requests, invitations, or administrative notices, using legitimate-looking business or organizational senders to deliver links that funnel recipients through .su-based redirect infrastructure, a technique commonly used to obscure the final malicious destination.

References

No references.

Sublime Security
Created Aug 13th, 2026 • Last updated Aug 13th, 2026
Source
type.inbound
and profile.by_sender_email().days_known < 7
and any(body.links,
        .href_url.domain.tld != "su"
        and any(ml.link_analysis(.).redirect_history, .domain.tld == "su")
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started