Medium Severity

Open redirect: Artisteer

Description

Message contains use of the Artisteer open redirect, but the sender is not Artisteer. This has been exploited in the wild.

References

No references.

Sublime Security
Created Sep 11th, 2024 • Last updated May 23rd, 2025
Source
type.inbound
and any(body.links,
        .href_url.domain.root_domain == 'artisteer.com'
        and strings.icontains(.href_url.query_params, 'redirect_url=')
        and strings.icontains(.href_url.query_params, 'p=affr')
)
and sender.email.domain.root_domain != 'artisteer.com'

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.