Link: Observed malicious URL path /redirect/redirect/

calendar Aug 12, 2026  ·
Share on: linkedin copy

Inbound messages containing links whose path includes a repeated '/redirect/redirect/' segment. Observed lures include fake academic transcript notices, internal administrative notices, and generic invitations sent from a mix of compromised or unrelated legitimate domains, all leveraging the nested redirect to bypass link-scanning defenses and lead recipients to malicious landing pages.

Sublime rule (View on GitHub)

 1name: "Link: Observed malicious URL path /redirect/redirect/"
 2description: "Inbound messages containing links whose path includes a repeated '/redirect/redirect/' segment. Observed lures include fake academic transcript notices, internal administrative notices, and generic invitations sent from a mix of compromised or unrelated legitimate domains, all leveraging the nested redirect to bypass link-scanning defenses and lead recipients to malicious landing pages."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(body.links, strings.icontains(.href_url.path, '/redirect/redirect/'))  
 8attack_types:
 9  - "Credential Phishing"
10tactics_and_techniques:
11  - "Open redirect"
12  - "Social engineering"
13  - "Evasion"
14detection_methods:
15  - "URL analysis"
16  - "Content analysis"
17id: "98e31dcf-f42c-5968-a6c7-0f664bb1217c"
to-top