Detection Method: URL analysis

URL analysis scans links in emails, attachments, or embedded content to find malicious destinations aimed at stealing your credentials, delivering malware, or launching other types of attacks. This method looks at key factors like the structure of the URL, redirection paths, domain reputation, and what the link shows when clicked.
URL analysis can help you detect:
  • Phishing sites pretending to be trusted login pages
  • Malicious domains hidden through URL shorteners or redirects
  • Login forms on suspicious or newly registered domains
  • Brand impersonation using slight domain tweaks (typosquatting or homograph attacks)
  • Suspicious URLs with weird characters or unusual patterns
For example, attackers often use redirect chains to hide their final destination from security scanners. With URL analysis, we can follow these redirects to reveal the true destination and assess the potential threat.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Attachment: ICS voicemail lure with suspicious link
1h ago
Sep 16th, 2026
Sublime Security
Attachment: PDF with a suspicious string and single URL
2h ago
Sep 16th, 2026
Sublime Security
Suspicious attachment with unscannable Cloudflare link
4h ago
Sep 16th, 2026
Sublime Security
Suspicious message with unscannable Cloudflare link
4h ago
Sep 16th, 2026
Sublime Security
Brand impersonation: Social Security Administration
6h ago
Sep 16th, 2026
Sublime Security
Attachment: ICS calendar invite with bid/RFP lure and suspicious link
22h ago
Sep 15th, 2026
Sublime Security
Link: Possible Intuit link abuse
22h ago
Sep 15th, 2026
Sublime Security
Attachment: Legal themed message or PDF with suspicious indicators
1d ago
Sep 15th, 2026
Sublime Security
Link: Abused Trac-link URL
2d ago
Sep 14th, 2026
Sublime Security
Credential phishing: Generic document sharing
2d ago
Sep 14th, 2026
Sublime Security
Attachment: ICS calendar invite with Google share.google URL shortener in google.<tld>/share.google path form
2d ago
Sep 14th, 2026
Sublime Security
Attachment: Google share.google URL shortener in google.<tld>/share.google path form
2d ago
Sep 14th, 2026
Sublime Security
Link: Google share.google URL shortener in google.<tld>/share.google path form
2d ago
Sep 14th, 2026
Sublime Security
Link: ScreenConnect remote access tool delivery with unattended guest access
5d ago
Sep 11th, 2026
Sublime Security
Spam: Fake photo share
5d ago
Sep 11th, 2026
Sublime Security
Link: Multistage landing - Abused Adobe Acrobat hosted PDF
5d ago
Sep 11th, 2026
Sublime Security
Attachment: Excel file with hyperlinks to suspicious domains
5d ago
Sep 11th, 2026
Sublime Security
Link: Fake Cloudflare verification landing page
5d ago
Sep 11th, 2026
Sublime Security
Link: Suspicious TLD hosting client.js with cf beacon
5d ago
Sep 11th, 2026
Sublime Security
Brand impersonation: Google Drive fake file share
6d ago
Sep 10th, 2026
Sublime Security