• Sublime Core Feed

Description

Doubleclick.net link leveraging an open redirect from a new or outlier sender.

References

No references.

Sublime Security
Created Jan 22nd, 2024 • Last updated May 23rd, 2025
Source
type.inbound
and length(body.links) < 10
and any(body.links,
        .href_url.domain.root_domain == "doubleclick.net"
        and (
          strings.icontains(.href_url.path, "/aclk")
          or strings.icontains(.href_url.path, "/pcs/click")
          or strings.icontains(.href_url.path, "/searchads/link/click")
        )
        and regex.icontains(.href_url.query_params,
                            '&(?:adurl|ds_dest_url)=(?:[a-z]+(?:\:|%3a))?(?:\/|%2f)(?:\/|%2f)'
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started