This rule focuses on inbound messages that embed links using the on-Google-domain path google.<tld>/share.google with a query parameter named q. It detects links where the URL's second-level domain is google, the path begins with /share.google, and the decoded query parameters include a q. The intent appears to be to abuse Google's share.google URL shortener form on a non-public subdomain to conceal the final destination, enabling an open redirect or spear-phish-style redirect to attacker-controlled sites. Although Google publicly documents share.google on the Google domain, this specific on-Google-domain path or its q parameter is undocumented, suggesting attacker misuse. By leveraging a trusted domain, the link can evade simple domain-block filters and lower user suspicion. Consequently, inbound messages containing such links are flagged as potential Spam or Credential Phishing, aligned with social engineering to induce clicks and possible credential collection. Detection methods comprise URL analysis (parsing link structures, domain, path, and query param presence) and content analysis (inspecting the message body for links). The rule’s scope is medium severity given the potential impact but also potential false positives due to legitimate usage or aliasing of the share.google scheme; additional correlation with sender reputation, message context, and destination site behavior should be used to reduce noise. Recommended mitigations: maintain up-to-date URL reputation databases, enforce link sandboxing or image-free viewing, apply MFA for sensitive accounts, and monitor for similar URL patterns with broader scope. Consider whitelisting legitimate Google share URLs if verified.