Link: URL shortener chaining to workers.dev redirect

 1name: "Link: URL shortener chaining to workers.dev redirect"
 2description: "Detects inbound messages containing shortened links that ultimately redirect to or embed content hosted on workers.dev, a Cloudflare Workers subdomain frequently abused to host credential phishing or malicious redirect infrastructure. Observed lures include fake business inquiry notifications, advertising account verification alerts, and order/checkout confirmation messages designed to entice recipients into clicking the shortened link. This chaining technique obscures the final malicious destination behind a trusted URL shortener before landing on abused cloud infrastructure."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain in $url_shorteners
 9          and (
10            any(ml.link_analysis(.).final_dom.links,
11                .href_url.domain.root_domain == "workers.dev"
12            )
13  
14            // or the thing just redirects to workers.dev directly
15            or any(ml.link_analysis(.).redirect_history,
16                   .domain.root_domain == "workers.dev"
17            )
18          )
19  )  
20tags:
21  - "Attack surface reduction"
22attack_types:
23  - "Credential Phishing"
24tactics_and_techniques:
25  - "Open redirect"
26  - "Free subdomain host"
27  - "Social engineering"
28  - "Evasion"
29detection_methods:
30  - "URL analysis"
31  - "Threat intelligence"
32id: "6d8aca1f-d235-5afa-9b7e-fbe4475f6201"