Sublime Security medium experimental mql

Link: Google Cloud Storage with short-path link delivery

Detects inbound messages containing links to Google Cloud Storage (storage.googleapis.com) where the URL path ends in 'ls' or 'lis', matching a pattern used to host redirector or landing pages. Observed across multilingual spam and unsolicited promotional messages — including fake parcel delivery notifications impersonating FedEx and T&T, as well as product advertisement lures — sent from a variety of compromised or unrelated sender domains. The consistent use of this specific GCS path pattern suggests a shared delivery infrastructure across multiple senders.

View Source

Detection Logic

type.inbound
and any(body.links,
        .href_url.domain.domain == "storage.googleapis.com"
        // path ends with lis or ls
        and regex.icontains(.href_url.path, '^/[^\/]+/li?s$')
)

Field Validations

Loading…

Comments (0)

Loading comments...