Detection Method: URL analysis

URL analysis scans links in emails, attachments, or embedded content to find malicious destinations aimed at stealing your credentials, delivering malware, or launching other types of attacks. This method looks at key factors like the structure of the URL, redirection paths, domain reputation, and what the link shows when clicked.
URL analysis can help you detect:
  • Phishing sites pretending to be trusted login pages
  • Malicious domains hidden through URL shorteners or redirects
  • Login forms on suspicious or newly registered domains
  • Brand impersonation using slight domain tweaks (typosquatting or homograph attacks)
  • Suspicious URLs with weird characters or unusual patterns
For example, attackers often use redirect chains to hide their final destination from security scanners. With URL analysis, we can follow these redirects to reveal the true destination and assess the potential threat.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: Partiful
3h ago
Oct 26th, 2026
Sublime Security
Link: Multistage landing - Abused Adobe Acrobat hosted PDF
3h ago
Oct 26th, 2026
Sublime Security
Link: Romance/Sexual Language With Suspicious Link
4h ago
Oct 26th, 2026
Sublime Security
Attachment: PDF with a suspicious string and single URL
4d ago
Oct 23rd, 2026
Sublime Security
Brand impersonation: Google Workspace alert notification
4d ago
Oct 23rd, 2026
Sublime Security
Link: home.php affiliate tracking token
4d ago
Oct 23rd, 2026
Sublime Security
Service abuse: Power BI shared document lure
4d ago
Oct 23rd, 2026
Sublime Security
Link: Zoho form link from unsolicited sender
4d ago
Oct 23rd, 2026
Sublime Security
Link: Google Cloud Storage with word-triple bucket and random HTML object
4d ago
Oct 23rd, 2026
Sublime Security
Link: Google Cloud Storage object named after its bucket
4d ago
Oct 23rd, 2026
Sublime Security
Link: Google Cloud Storage /index and /unsub link pair
4d ago
Oct 23rd, 2026
Sublime Security
Service abuse: Microsoft messaging with Cloudflare Turnstile-gated link
4d ago
Oct 23rd, 2026
Sublime Security
Link: Google Cloud Storage with double base64 encoded fragment
4d ago
Oct 23rd, 2026
Sublime Security
Link: Google Cloud Storage hex filename pattern
5d ago
Oct 22nd, 2026
Sublime Security
Link: Large guest list with suspicious link
5d ago
Oct 22nd, 2026
Sublime Security
Credential phishing: Suspicious e-sign agreement document notification
5d ago
Oct 22nd, 2026
Sublime Security
Link: Randomly generated subdomain
6d ago
Oct 21st, 2026
Sublime Security
Attachment: ICS voicemail lure with suspicious link
13d ago
Oct 14th, 2026
Sublime Security
Link: Suspicious Office 365 app authorization (OAuth) link
13d ago
Oct 14th, 2026
Sublime Security
Attachment: Microsoft OAuth credential harvesting via EML with embedded malicious links
13d ago
Oct 14th, 2026
Sublime Security