Detection Method: URL analysis

URL analysis scans links in emails, attachments, or embedded content to find malicious destinations aimed at stealing your credentials, delivering malware, or launching other types of attacks. This method looks at key factors like the structure of the URL, redirection paths, domain reputation, and what the link shows when clicked.
URL analysis can help you detect:
  • Phishing sites pretending to be trusted login pages
  • Malicious domains hidden through URL shorteners or redirects
  • Login forms on suspicious or newly registered domains
  • Brand impersonation using slight domain tweaks (typosquatting or homograph attacks)
  • Suspicious URLs with weird characters or unusual patterns
For example, attackers often use redirect chains to hide their final destination from security scanners. With URL analysis, we can follow these redirects to reveal the true destination and assess the potential threat.
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Brand impersonation: DocuSign
3d ago
Apr 17th, 2026
Sublime Security
Link: WordPress admin targeting with recipient identifier in URL fragment
4d ago
Apr 16th, 2026
Sublime Security
Service abuse: Meetup.com redirect with brand impersonation
5d ago
Apr 15th, 2026
Sublime Security
Link: Tax document lure Portuguese/Spanish with suspicious domains
6d ago
Apr 14th, 2026
Sublime Security
Attachment: Fake voicemail via PDF
6d ago
Apr 14th, 2026
Sublime Security
Attachment: PDF with a suspicious string and single URL
10d ago
Apr 10th, 2026
Sublime Security
Link: Shortened URL with fragment matching subject
11d ago
Apr 9th, 2026
Sublime Security
Cloud storage impersonation with credential theft indicators
11d ago
Apr 9th, 2026
Sublime Security
Attachment: Calendar invite with Google redirect and invoice request
12d ago
Apr 8th, 2026
Sublime Security
Service abuse: Mimecast URL with excessive path length
12d ago
Apr 8th, 2026
Sublime Security
Service abuse: GitHub notification with excessive mentions and suspicious links
13d ago
Apr 7th, 2026
Sublime Security
Link: Landing page with search-ms protocol redirect
13d ago
Apr 7th, 2026
Sublime Security
Link: Job recruitment lure from unsolicited sender with suspicious hosting
13d ago
Apr 7th, 2026
Sublime Security
Brand impersonation: Zoom via lookalike domain
13d ago
Apr 7th, 2026
Sublime Security
Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure
14d ago
Apr 6th, 2026
Sublime Security
QR Code with suspicious indicators
14d ago
Apr 6th, 2026
Sublime Security
Attachment: Legal themed message or PDF with suspicious indicators
17d ago
Apr 3rd, 2026
Sublime Security
Service abuse: Google Firebase sender address with suspicious content
18d ago
Apr 2nd, 2026
Sublime Security
Link: Personalized URL with recipient address on commonly abused web service
19d ago
Apr 1st, 2026
Sublime Security
Attachment: ICS file with AWS Lambda URL
19d ago
Apr 1st, 2026
Sublime Security