Open redirect: SiteScout pixel tracking

calendar Nov 12, 2026  ·
Share on: linkedin copy

Detects inbound emails containing links that use pixel.sitescout.com's /iap/ tracking pixel endpoint with a populated 'r' redirect parameter, a known open redirect abused to disguise malicious destination URLs. The rule excludes messages from highly trusted sender domains that successfully pass DMARC authentication to reduce false positives.

Sublime rule (View on GitHub)

 1name: "Open redirect: SiteScout pixel tracking"
 2description: "Detects inbound emails containing links that use pixel.sitescout.com's /iap/ tracking pixel endpoint with a populated 'r' redirect parameter, a known open redirect abused to disguise malicious destination URLs. The rule excludes messages from highly trusted sender domains that successfully pass DMARC authentication to reduce false positives."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "pixel.sitescout.com"
 9          and strings.istarts_with(.href_url.path, '/iap/')
10          and length(.href_url.query_params_decoded['r']) > 0
11  )
12  
13  // negate highly trusted sender domains unless they fail DMARC authentication
14  and not (
15    sender.email.domain.root_domain in $high_trust_sender_root_domains
16    and coalesce(headers.auth_summary.dmarc.pass, false)
17  )  
18attack_types:
19  - "Credential Phishing"
20  - "Spam"
21tactics_and_techniques:
22  - "Open redirect"
23  - "Evasion"
24detection_methods:
25  - "URL analysis"
26  - "Header analysis"
27  - "Sender analysis"
28id: "ae91e2a8-bbf0-5aaf-ab0b-109eb1ddc94d"
to-top