Open redirect: Newslit.co

calendar Oct 9, 2026  ·
Share on: linkedin copy

Detects inbound messages containing links that abuse the newslit.co email redirect service, where the redirect destination (query parameter 'u') does not point back to newslit.co itself. Excludes messages from newslit.co or other highly trusted sender domains that pass DMARC authentication.

Sublime rule (View on GitHub)

 1name: "Open redirect: Newslit.co"
 2description: "Detects inbound messages containing links that abuse the newslit.co email redirect service, where the redirect destination (query parameter 'u') does not point back to newslit.co itself. Excludes messages from newslit.co or other highly trusted sender domains that pass DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.root_domain == "newslit.co"
 9          and strings.istarts_with(.href_url.path, '/email/redirect/')
10          and length(.href_url.query_params_decoded["u"]) > 0
11          // make sure it's not redirecting back to newslit.co
12          and not any(.href_url.query_params_decoded["u"],
13                      strings.parse_url(.).domain.root_domain == "newslit.co"
14          )
15  )
16  and not (
17    sender.email.domain.root_domain == "newslit.co"
18    and coalesce(headers.auth_summary.dmarc.pass, false)
19  )
20  // negate highly trusted sender domains unless they fail DMARC authentication
21  and not (
22    sender.email.domain.root_domain in $high_trust_sender_root_domains
23    and coalesce(headers.auth_summary.dmarc.pass, false)
24  )  
25attack_types:
26  - "Credential Phishing"
27  - "Spam"
28tactics_and_techniques:
29  - "Open redirect"
30detection_methods:
31  - "URL analysis"
32  - "Header analysis"
33id: "a2b417c2-3c4e-5daa-a827-b5e21ba30d64"
to-top