Link: Google Cloud Storage with prefixed base64 dash-record fragment

calendar Oct 6, 2026  ·
Share on: linkedin copy

Detects Google Cloud Storage links whose fragment holds a 30 character prefix, a click/unsubscribe marker, and a base64 encoded dash-separated tracking record. Observed in fake account suspension, health and warranty spam.

Sublime rule (View on GitHub)

 1name: "Link: Google Cloud Storage with prefixed base64 dash-record fragment"
 2description: "Detects Google Cloud Storage links whose fragment holds a 30 character prefix, a click/unsubscribe marker, and a base64 encoded dash-separated tracking record. Observed in fake account suspension, health and warranty spam."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "storage.googleapis.com"
 9          and regex.match(.href_url.fragment[:31], '[A-Z0-9]{30}[ru]')
10          and regex.imatch(strings.decode_base64(.href_url.fragment[31:],
11                                                 ignore_padding=true
12                           ),
13                           '\d+-\d+-\d+-[a-z]-\d+-\d+-\d+-\d+-\d+-\d+-\d+-\d+-[a-z0-9]{9}-[0-9a-f]{8}'
14          )
15  )  
16attack_types:
17  - "Credential Phishing"
18  - "Spam"
19tactics_and_techniques:
20  - "Free file host"
21  - "Social engineering"
22  - "Evasion"
23detection_methods:
24  - "URL analysis"
25id: "083bd39c-2486-5cda-9037-9bf01e652a6d"
to-top