Medium Severity

Link: Base64-encoded redirect URL

Labels

Credential Phishing

Open redirect

Description

Identifies inbound messages containing links where the URL path includes a base64-encoded string that, once decoded, either reveals an embedded destination URL (via a 'u' parameter) or resolves to a known URL shortener domain. This obfuscation technique is commonly used to disguise the true destination of a link and evade detection.

References

No references.

Sublime Security

Created Oct 14th, 2026 • Last updated Oct 14th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and 0 < length(body.current_thread.links) <= 3
and any(body.links,
        any(regex.iextract(.href_url.path,
                           '/[a-z]{1,3}/([A-Za-z0-9+/=_-]{20,})'
            ),
            any(regex.iextract(strings.decode_base64(.groups[0],
                                                     ignore_padding=true
                               ),
                               '"u":"(https?://[^"]+)"'
                ),
                strings.parse_url(.groups[0]).domain.root_domain in $url_shorteners
            )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.