Detect Emails with Obfuscated URLs

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•4

This rule detects emails containing multiple obfuscated URLs from common URL shortening services (bit.ly, tinyurl, short.link) originating from external senders. It specifically looks for emails with 3 or more such URLs within a one-hour window from the same sender.