Link: Google Cloud Storage with zipper-interleaved tracking token

calendar Oct 6, 2026  ·
Share on: linkedin copy

Detects inbound emails containing links to storage.googleapis.com where the URL fragment or query string contains a highly specific alphanumeric token pattern. This structured token format is characteristic of a known phishing kit that abuses Google Cloud Storage to host and deliver malicious content, leveraging the trusted domain to bypass security filters.

Sublime rule (View on GitHub)

 1name: "Link: Google Cloud Storage with zipper-interleaved tracking token"
 2description: "Detects inbound emails containing links to storage.googleapis.com where the URL fragment or query string contains a highly specific alphanumeric token pattern. This structured token format is characteristic of a known phishing kit that abuses Google Cloud Storage to host and deliver malicious content, leveraging the trusted domain to bypass security filters."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "storage.googleapis.com"
 9          // token in the fragment/query
10          and any([.href_url.fragment, .href_url.query_params],
11                  regex.icontains(.,
12                                  '\b\d{7}[a-z]{2}\d{7,8}[a-z]{2}\d{9}[a-z]{2}\d{3,5}[a-z]{2}24[a-z]{2}[ru]\d{6}[a-z]{2}\b'
13                  )
14          )
15  )  
16attack_types:
17  - "Credential Phishing"
18tactics_and_techniques:
19  - "Free file host"
20  - "Evasion"
21detection_methods:
22  - "URL analysis"
23id: "0a5c7165-8dd6-51be-923f-611c9782bc33"
to-top