Open redirect: Generic link.html redirector abuse

calendar Sep 1, 2026  ·
Share on: linkedin copy

Detects messages that route recipients through a generic '/link.html' redirect path carrying an encoded destination in the URL fragment, then confirms via redirect-chain analysis that the link actually resolves to that embedded destination. This pattern is commonly abused in bulk spam and scam lures—such as fake storage-deletion warnings, loan offers, and discounted warranty plans—to disguise the true landing page behind a benign-looking tracking link.

Sublime rule (View on GitHub)

 1name: "Open redirect: Generic link.html redirector abuse"
 2description: "Detects messages that route recipients through a generic '/link.html' redirect path carrying an encoded destination in the URL fragment, then confirms via redirect-chain analysis that the link actually resolves to that embedded destination. This pattern is commonly abused in bulk spam and scam lures—such as fake storage-deletion warnings, loan offers, and discounted warranty plans—to disguise the true landing page behind a benign-looking tracking link."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(body.links,
 8                 strings.iends_with(.href_url.path, '/link.html')
 9                 and .href_url.fragment is not null
10          ),
11          ml.link_analysis(.).submitted
12          and length(ml.link_analysis(.).redirect_history) > 1
13          and any(ml.link_analysis(.).redirect_history,
14                  strings.contains(.path, ..href_url.fragment)
15          )
16  )  
17attack_types:
18  - "Spam"
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "Open redirect"
22  - "Social engineering"
23detection_methods:
24  - "URL analysis"
25  - "Content analysis"
26id: "9b715c35-6c35-5a41-a1a0-bb26ee1ade78"
to-top