Cert.pl Phishing Domain List EmailUrl Detection

Benjamin Zulliger@benscha

•updated Sep 17, 2025•3•3•196

This rule detects emails containing URLs that match domains identified as phishing domains by cert.pl. It joins email URL information with a regularly updated list of known malicious domains from cert.pl and then correlates these with email events to identify potential phishing attempts.