Medium Severity

Link: Echo-tail od= affiliate tracking token

Description

Detects links carrying a known affiliate tracking token pattern. Observed in account suspension, payment and prize spam.

References

No references.

Sublime Security
Created Oct 6th, 2026 • Last updated Oct 8th, 2026
Source
type.inbound
and any(body.links,
        regex.contains(.href_url.url,
                       '[?&]od=[0-9][a-z]{2,3}[0-9A-Za-z_]*[./][0-9a-z]{6,7}[./][a-z]{0,3}[A-Z][0-9a-z]{10,24}_x[a-z]{0,3}\d{3,5}[a-z]{0,3}[./][0-9a-z]{5}[A-Za-z0-9+/_\]]{14,}'
        )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started