diff --git a/detection-rules/link_fake_webmail_hosting.yml b/detection-rules/link_fake_webmail_hosting.yml
new file mode 100644
index 00000000000..e14e9baaa86
--- /dev/null
+++ b/detection-rules/link_fake_webmail_hosting.yml
@@ -0,0 +1,25 @@
+name: "Link: Fake webmail hosting"
+description: "Detects inbound messages that impersonate a webmail hosting service by including an HTML heading referencing 'Webmail HostingServer' or by using a link whose display text and destination are both set to an email address (support@webmail.com)."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and (
+    any(html.xpath(body.html, '//h3').nodes,
+        .inner_text == "Webmail HostingServer"
+    )
+    or (
+      any(body.links,
+          .display_url.url == "support@webmail.com"
+          and .href_url.url == "support@webmail.com"
+      )
+    )
+  )
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Social engineering"
+detection_methods:
+  - "HTML analysis"
+  - "URL analysis"
+id: "d8218991-489e-51b4-8be9-991f627ce9a5"