Medium Severity

Open redirect: Generic link.html redirector abuse

Labels

Spam

Credential Phishing

Description

Detects messages that route recipients through a generic '/link.html' redirect path carrying an encoded destination in the URL fragment, then confirms via redirect-chain analysis that the link actually resolves to that embedded destination. This pattern is commonly abused in bulk spam and scam lures—such as fake storage-deletion warnings, loan offers, and discounted warranty plans—to disguise the true landing page behind a benign-looking tracking link.

References

No references.

Sublime Security

Created Sep 1st, 2026 • Last updated Sep 1st, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(filter(body.links,
               strings.iends_with(.href_url.path, '/link.html')
               and .href_url.fragment is not null
        ),
        ml.link_analysis(.).submitted
        and length(ml.link_analysis(.).redirect_history) > 1
        and any(ml.link_analysis(.).redirect_history,
                strings.contains(.path, ..href_url.fragment)
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.