Finance-Brand Phishing via ActiveCampaign Tracking URL Pivot

Ankit Mehta@Secvyn

•updated Sep 5, 2026•1•0•1

Detects inbound emails where the sender domain mimics finance-themed brands (using a regex-based pattern) and includes URLs redirecting through the ActiveCampaign platform tracking domains (activehosted.com or acemlnd.com). This rule identifies potential phishing campaigns attempting to use legitimate email marketing infrastructure to bypass reputation-based filters.