Link: Google Cloud Storage with double base64 encoded fragment

calendar Oct 23, 2026  ·
Share on: linkedin copy

Detects Google Cloud Storage links whose fragment is a base64 encoded value that decodes to another base64 value, a known actor-controlled redirect token pattern. Observed in reward and account suspension spam.

Sublime rule (View on GitHub)

 1name: "Link: Google Cloud Storage with double base64 encoded fragment"
 2description: "Detects Google Cloud Storage links whose fragment is a base64 encoded value that decodes to another base64 value, a known actor-controlled redirect token pattern. Observed in reward and account suspension spam."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "storage.googleapis.com"
 9          and regex.match(.href_url.fragment, '[A-Za-z0-9+/]{100,160}={0,2}')
10          and regex.match(strings.decode_base64(.href_url.fragment,
11                                                ignore_padding=true
12                          ),
13                          '[A-Za-z0-9+/]{80,120}={0,2}'
14          )
15  )  
16attack_types:
17  - "Spam"
18tactics_and_techniques:
19  - "Free file host"
20  - "Evasion"
21detection_methods:
22  - "URL analysis"
23id: "2853361b-d899-5258-a4ba-ba293aa8f66e"
to-top