Medium Severity

Link: URL shortener chaining to workers.dev redirect

Labels

Credential Phishing

Open redirect

Description

Detects inbound messages containing shortened links that ultimately redirect to or embed content hosted on workers.dev, a Cloudflare Workers subdomain frequently abused to host credential phishing or malicious redirect infrastructure. Observed lures include fake business inquiry notifications, advertising account verification alerts, and order/checkout confirmation messages designed to entice recipients into clicking the shortened link. This chaining technique obscures the final malicious destination behind a trusted URL shortener before landing on abused cloud infrastructure.

References

No references.

Sublime Security

Created Aug 10th, 2026 • Last updated Aug 10th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(body.links,
        .href_url.domain.domain in $url_shorteners
        and (
          any(ml.link_analysis(.).final_dom.links,
              .href_url.domain.root_domain == "workers.dev"
          )

          // or the thing just redirects to workers.dev directly
          or any(ml.link_analysis(.).redirect_history,
                 .domain.root_domain == "workers.dev"
          )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.