Sublime Security medium experimental mql

Link: Google Cloud Storage redirect to external domain

Messages contain links hosted on storage.googleapis.com that, when followed, redirect to a destination outside of googleapis.com. This technique abuses Google Cloud Storage's trusted reputation to bypass link reputation checks, with the actual payload hosted on an unrelated external domain. Observed lures include parcel delivery notifications impersonating shipping carriers (UPS, GLS), gambling bonus offers, health product promotions, and storage quota warnings.

View Source

Detection Logic

type.inbound
and any(body.links,
        .href_url.domain.domain == "storage.googleapis.com"
        and ml.link_analysis(., mode="aggressive").effective_url.domain.root_domain != "googleapis.com"
)

Field Validations

Loading…

Comments (0)

Loading comments...