Detection Method: URL analysis

URL analysis scans links in emails, attachments, or embedded content to find malicious destinations aimed at stealing your credentials, delivering malware, or launching other types of attacks. This method looks at key factors like the structure of the URL, redirection paths, domain reputation, and what the link shows when clicked.
URL analysis can help you detect:
  • Phishing sites pretending to be trusted login pages
  • Malicious domains hidden through URL shorteners or redirects
  • Login forms on suspicious or newly registered domains
  • Brand impersonation using slight domain tweaks (typosquatting or homograph attacks)
  • Suspicious URLs with weird characters or unusual patterns
For example, attackers often use redirect chains to hide their final destination from security scanners. With URL analysis, we can follow these redirects to reveal the true destination and assess the potential threat.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Attachment: ICS calendar file with QR code containing recipient email address
2d ago
Apr 20th, 2026
Sublime Security
Attachment: ICS file with links to newly registered domains
2d ago
Apr 20th, 2026
Sublime Security
Brand impersonation: DocuSign
5d ago
Apr 17th, 2026
Sublime Security
Link: WordPress admin targeting with recipient identifier in URL fragment
6d ago
Apr 16th, 2026
Sublime Security
Service abuse: Meetup.com redirect with brand impersonation
7d ago
Apr 15th, 2026
Sublime Security
Link: Tax document lure Portuguese/Spanish with suspicious domains
8d ago
Apr 14th, 2026
Sublime Security
Attachment: Fake voicemail via PDF
8d ago
Apr 14th, 2026
Sublime Security
Attachment: PDF with a suspicious string and single URL
12d ago
Apr 10th, 2026
Sublime Security
Link: Shortened URL with fragment matching subject
13d ago
Apr 9th, 2026
Sublime Security
Cloud storage impersonation with credential theft indicators
13d ago
Apr 9th, 2026
Sublime Security
Attachment: Calendar invite with Google redirect and invoice request
14d ago
Apr 8th, 2026
Sublime Security
Service abuse: Mimecast URL with excessive path length
14d ago
Apr 8th, 2026
Sublime Security
Service abuse: GitHub notification with excessive mentions and suspicious links
15d ago
Apr 7th, 2026
Sublime Security
Link: Landing page with search-ms protocol redirect
15d ago
Apr 7th, 2026
Sublime Security
Link: Job recruitment lure from unsolicited sender with suspicious hosting
15d ago
Apr 7th, 2026
Sublime Security
Brand impersonation: Zoom via lookalike domain
15d ago
Apr 7th, 2026
Sublime Security
Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure
16d ago
Apr 6th, 2026
Sublime Security
QR Code with suspicious indicators
16d ago
Apr 6th, 2026
Sublime Security
Attachment: Legal themed message or PDF with suspicious indicators
19d ago
Apr 3rd, 2026
Sublime Security
Service abuse: Google Firebase sender address with suspicious content
20d ago
Apr 2nd, 2026
Sublime Security