Medium Severity

Link: URL using underscore-dot substitution in display text

Labels

Credential Phishing
Evasion
Social engineering
URL analysis
Content analysis

Description

Detects inbound messages containing links where the display text starts with 'https://' and uses an underscore followed by 'com/' in place of a standard dot-com domain format (e.g., 'example_com/'). This technique is used to bypass display text URL parsing, as the malformed URL cannot be resolved by standard URL parsers.

References

No references.

Sublime Security
Created Aug 7th, 2026 • Last updated Aug 7th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(body.links,
        strings.starts_with(.display_text, 'https://')
        and strings.contains(.display_text, '_com/')
        and not strings.contains(.display_text, '.com/')
        and strings.parse_url(.display_text).url is null
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started