Link: Giveaway lure with amsweb.php redirect path

calendar Oct 8, 2026  ·
Share on: linkedin copy

Detects links to an '/amsweb.php' path on a domain outside the Tranco 1M, the first hop of a known affiliate redirect chain. Observed in giveaway and prize spam impersonating insurance, retail and roadside-assistance brands, sent from disposable sender domains predominantly on the .pro TLD with homoglyph-substituted display names.

Sublime rule (View on GitHub)

 1name: "Link: Giveaway lure with amsweb.php redirect path"
 2description: "Detects links to an '/amsweb.php' path on a domain outside the Tranco 1M, the first hop of a known affiliate redirect chain. Observed in giveaway and prize spam impersonating insurance, retail and roadside-assistance brands, sent from disposable sender domains predominantly on the .pro TLD with homoglyph-substituted display names."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          strings.icontains(.href_url.path, '/amsweb.php')
 9          and .href_url.domain.root_domain not in $tranco_1m
10  )
11  // negate highly trusted sender domains unless they fail DMARC authentication
12  and not (
13    sender.email.domain.root_domain in $high_trust_sender_root_domains
14    and coalesce(headers.auth_summary.dmarc.pass, false)
15  )  
16attack_types:
17  - "Spam"
18  - "BEC/Fraud"
19tactics_and_techniques:
20  - "Impersonation: Brand"
21  - "Social engineering"
22detection_methods:
23  - "URL analysis"
24id: "6085dc92-2075-5c9e-87a1-b4cee0e6c1b1"
to-top