Medium Severity
Open redirect: giving.lluh.org
Description
Message contains use of the giving.lluh.org redirect. This redirection has been abused by threat actors in the wild.
References
No references.
Sublime Security
Created Oct 30th, 2024 • Last updated May 23rd, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
and any(body.links,
.href_url.domain.domain == "giving.lluh.org"
and .href_url.path =~ "/site/UserLogin"
and strings.icontains(.href_url.query_params, 'nexturl=')
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Playground
Test against your own EMLs or sample data.