Link: Google Cloud Storage with base64 go/sub-ID fragment

calendar Oct 6, 2026  ·
Share on: linkedin copy

Detects Google Cloud Storage links whose fragment is a base64 encoded affiliate query (go, s1, s2, s3) carrying a click/unsubscribe flag and per-recipient ID. Observed in free kit and parcel delivery spam.

Sublime rule (View on GitHub)

 1name: "Link: Google Cloud Storage with base64 go/sub-ID fragment"
 2description: "Detects Google Cloud Storage links whose fragment is a base64 encoded affiliate query (go, s1, s2, s3) carrying a click/unsubscribe flag and per-recipient ID. Observed in free kit and parcel delivery spam."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "storage.googleapis.com"
 9          // base64 tracking query hidden in the fragment (go=1 click, go=2 unsubscribe)
10          and regex.imatch(strings.decode_base64(.href_url.fragment[1:],
11                                                 ignore_padding=true
12                           ),
13                           'go=[12]&s1=\d+&s2=\d+&s3=[a-z]+'
14          )
15  )  
16attack_types:
17  - "Spam"
18tactics_and_techniques:
19  - "Free file host"
20  - "Social engineering"
21  - "Evasion"
22detection_methods:
23  - "URL analysis"
24id: "4e20f50d-2231-50ca-b438-56cbdbcb61b4"
to-top