• Sublime Core Feed
Medium Severity

Open Redirect: convertcart.com

Labels

Credential Phishing
Malware/Ransomware
Open redirect
Sender analysis
URL analysis

Description

Message contains use of the convertcart.com redirect. This has been exploited in the wild.

References

No references.

Sublime Security
Created Feb 24th, 2025 • Last updated Feb 24th, 2025
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
// convertcart is used in benign messages, however, they commonly have many links
// ensure messages contain less than 10 links convertcart.com to ensure higher fidelity matching of malicious messages
and length(filter(body.links, .href_url.domain.root_domain == "convertcart.com")) < 10
and any(body.links,
        .href_url.domain.root_domain == "convertcart.com"
        and strings.iends_with(.href_url.path, '/click')
        and strings.icontains(.href_url.query_params, 'url=')
        and not regex.icontains(.href_url.query_params,
                                  'url=(?:https?(?:%3a|:))?(?:%2f|\/){2}[^&]*convertcart\.com(?:\&|\/|$|%2f)'
        )
        and not strings.icontains(.href_url.query_params,
                                  sender.email.domain.root_domain
        )
)
// remove uses that originate from convertcart.com
and not any(headers.domains, .root_domain in ("convertcart.com", "convertc.com"))
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started