Open redirect: Nested Doubleclick.net

calendar Jan 12, 2026  ·
Share on: linkedin copy

Doubleclick.net link leveraging a nested doubleclick.net open redirect from a new or outlier sender. The unusual behavior of nesting a doubleclick URL inside another doubleclick link warrants increasing the severity of this rule.

Sublime rule (View on GitHub)

 1name: "Open redirect: Nested Doubleclick.net"
 2description: "Doubleclick.net link leveraging a nested doubleclick.net open redirect from a new or outlier sender. The unusual behavior of nesting a doubleclick URL inside another doubleclick link warrants increasing the severity of this rule."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(body.links) < 10
 8  and any(body.links,
 9          .href_url.domain.root_domain == "doubleclick.net"
10          and (
11            strings.icontains(.href_url.path, "/aclk")
12            or strings.icontains(.href_url.path, "/pcs/click")
13            or strings.icontains(.href_url.path, "/searchads/link/click")
14          )
15          and regex.icontains(.href_url.query_params,
16                              '&(?:adurl|ds_dest_url)=(?:https?(\:|%3a))?(?:\/|%2f)(?:\/|%2f)adclick.g.doubleclick.net'
17          )
18  )  
19attack_types:
20  - "Credential Phishing"
21  - "Malware/Ransomware"
22tactics_and_techniques:
23  - "Open redirect"
24detection_methods:
25  - "Sender analysis"
26  - "URL analysis"
27id: "bbed5cc6-4c39-5a53-9255-269cbd4e27cb"
to-top