Medium Severity

Open redirect: Recipient address embedded in redirect URL pointing to newly registered domain

Labels

Description

Detects inbound messages sent to a single recipient where the body contains a link that embeds the recipient's email address in a URL query parameter, and the resolved destination domain was registered less than 100 days ago. This pattern is consistent with personalized redirect links designed to evade detection while directing targets to newly established infrastructure.

References

No references.

Sublime Security

Created Jul 24th, 2026 • Last updated Jul 24th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and length(recipients.to) == 1
and any(body.current_thread.links,
        strings.contains(.href_url.url, recipients.to[0].email.email)
        and length(.href_url.query_params_decoded['url']) > 0
        and any(.href_url.query_params_decoded['url'],
                strings.contains(strings.parse_url(.).url,
                                 recipients.to[0].email.email
                )
                and network.whois(strings.parse_url(.).domain).days_old < 100
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.