Detection Method: URL analysis

URL analysis scans links in emails, attachments, or embedded content to find malicious destinations aimed at stealing your credentials, delivering malware, or launching other types of attacks. This method looks at key factors like the structure of the URL, redirection paths, domain reputation, and what the link shows when clicked.
URL analysis can help you detect:
  • Phishing sites pretending to be trusted login pages
  • Malicious domains hidden through URL shorteners or redirects
  • Login forms on suspicious or newly registered domains
  • Brand impersonation using slight domain tweaks (typosquatting or homograph attacks)
  • Suspicious URLs with weird characters or unusual patterns
For example, attackers often use redirect chains to hide their final destination from security scanners. With URL analysis, we can follow these redirects to reveal the true destination and assess the potential threat.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: Zoom via lookalike domain
11h ago
Jun 22nd, 2026
Sublime Security
Body: Fake secure email portal with HTML obfuscation
5d ago
Jun 18th, 2026
Sublime Security
Link: Mamba 2FA phishing kit
5d ago
Jun 18th, 2026
Sublime Security
Brand impersonation: Cloud services with credential theft intent
5d ago
Jun 18th, 2026
Sublime Security
Service abuse: Google Firebase sender address with suspicious content
5d ago
Jun 18th, 2026
Sublime Security
Brand impersonation: Bids & Tenders
6d ago
Jun 17th, 2026
Sublime Security
Service abuse: Outlook Groups with Google Sites link and evasion tag
6d ago
Jun 17th, 2026
Sublime Security
Attachment: PDF with a suspicious string and single URL
6d ago
Jun 17th, 2026
Sublime Security
Link: Romance/Sexual Language With Suspicious Link
6d ago
Jun 17th, 2026
Sublime Security
Brand impersonation: Fake Fax
6d ago
Jun 17th, 2026
Sublime Security
Suspicious Office 365 app authorization (OAuth) link
7d ago
Jun 16th, 2026
Sublime Security
Impersonation: Fake product discount promotion
7d ago
Jun 16th, 2026
Sublime Security
Fake Zoom meeting invite with suspicious link
7d ago
Jun 16th, 2026
Sublime Security
Credential phishing: Generic document sharing
8d ago
Jun 15th, 2026
Sublime Security
Link: Concatenated display text concealing duplicate URLs with PDF reference
11d ago
Jun 12th, 2026
Sublime Security
Link: SVG with embedded recipient data
11d ago
Jun 12th, 2026
Sublime Security
Link: Suspicious file retrieval with recipient targeting
11d ago
Jun 12th, 2026
Sublime Security
Link: Flare-branded credential harvesting via Cloudflare tunnels
11d ago
Jun 12th, 2026
Sublime Security
Link: Observed URL pattern with specific domain registrar
11d ago
Jun 12th, 2026
Sublime Security
Brand impersonation: Social Security Administration
12d ago
Jun 11th, 2026
Sublime Security