Open redirect: business.google.com website_shared URL Param

calendar Sep 23, 2026  ·
Share on: linkedin copy

Detects messages containing an open redirect in business.google.com's website_shared/launch_bw.html endpoint with the 'f' parameter. This has been exploited in phishing campaigns to redirect users to malicious sites.

Sublime rule (View on GitHub)

 1name: "Open redirect: business.google.com website_shared URL Param"
 2description: |
 3  Detects messages containing an open redirect in business.google.com's 
 4  website_shared/launch_bw.html endpoint with the 'f' parameter. This has been 
 5  exploited in phishing campaigns to redirect users to malicious sites.  
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  and any(body.links,
11          .href_url.domain.domain == "business.google.com"
12          and strings.icontains(.href_url.path, '/website_shared/launch_bw.html')
13          and strings.icontains(.href_url.query_params, 'f=')
14          // Make sure the redirect is not going back to google.com
15          and not regex.icontains(.href_url.query_params,
16                                  'f=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*google\.com(?:\&|\/|$|%2f)'
17          )
18  )
19  // Exclude legitimate Google domains as senders
20  and not regex.icontains(sender.email.domain.root_domain, '^google')
21  
22  // negate highly trusted sender domains unless they fail DMARC authentication
23  and not (
24    sender.email.domain.root_domain in $high_trust_sender_root_domains
25    and coalesce(headers.auth_summary.dmarc.pass, false)
26  )  
27attack_types:
28  - "Credential Phishing"
29  - "Malware/Ransomware"
30tactics_and_techniques:
31  - "Open redirect"
32detection_methods:
33  - "Sender analysis"
34  - "URL analysis"
35id: "f146be73-7200-570e-a033-a28814c5a098"
to-top