Sublime Security medium experimental mql

Open redirect: Doubleclick.net

Doubleclick.net link leveraging an open redirect from a new or outlier sender.

View Source

Detection Logic

type.inbound
and length(body.links) < 10
and any(body.links,
        .href_url.domain.root_domain == "doubleclick.net"
        and (
          strings.icontains(.href_url.path, "/aclk")
          or strings.icontains(.href_url.path, "/pcs/click")
          or strings.icontains(.href_url.path, "/searchads/link/click")
        )
        and regex.icontains(.href_url.query_params,
                            '&(?:adurl
| ds_dest_url)=(?:[a-z]+(?:\:
| %3a))?(?:\/
| %2f)(?:\/
| %2f)'
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...