Medium Severity
Open redirect: Newegg
Description
Message contains use of the Newegg open redirect, but the sender is not Newegg. This has been exploited in the wild.
References
No references.
Sublime Security
Created Sep 11th, 2024 • Last updated May 23rd, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
and any(body.links,
.href_url.domain.root_domain == 'newegg.com'
and .href_url.path =~ '/rts/go2.aspx'
and strings.icontains(.href_url.query_params, "x=")
)
and sender.email.domain.root_domain != 'newegg.com'
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Playground
Test against your own EMLs or sample data.
Share
Post about this on your socials.