Medium Severity

Link: Google Cloud Storage redirect to external domain

Labels

Credential Phishing
Spam
Malware/Ransomware
Free file host
Open redirect
Impersonation: Brand
Social engineering
Evasion
URL analysis
Threat intelligence

Description

Messages contain links hosted on storage.googleapis.com that, when followed, redirect to a destination outside of googleapis.com. This technique abuses Google Cloud Storage's trusted reputation to bypass link reputation checks, with the actual payload hosted on an unrelated external domain. Observed lures include parcel delivery notifications impersonating shipping carriers (UPS, GLS), gambling bonus offers, health product promotions, and storage quota warnings.

References

No references.

Sublime Security
Created Jun 30th, 2026 • Last updated Jun 30th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(body.links,
        .href_url.domain.domain == "storage.googleapis.com"
        and ml.link_analysis(., mode="aggressive").effective_url.domain.root_domain != "googleapis.com"
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started