Link: home.php affiliate tracking token

calendar Oct 23, 2026  ยท
Share on: linkedin copy

Detects links carrying a known affiliate tracking token pattern. Observed in health, reward and account suspension spam.

Sublime rule (View on GitHub)

 1name: "Link: home.php affiliate tracking token"
 2description: "Detects links carrying a known affiliate tracking token pattern. Observed in health, reward and account suspension spam."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          (
 9            strings.iends_with(.href_url.path, '.home.php')
10            and all(["sq", "lk"], . in keys(..href_url.query_params_decoded))
11          )
12          or (
13            strings.icontains(.href_url.fragment, '.home.php?sq=')
14            and strings.icontains(.href_url.fragment, '&lk')
15          )
16  )  
17attack_types:
18  - "Spam"
19tactics_and_techniques:
20  - "Free file host"
21  - "Evasion"
22detection_methods:
23  - "URL analysis"
24id: "cc0caa18-aa5c-508d-9892-5854015b024d"
to-top