heroui logo

Link: Google Cloud Storage object named after its bucket

Sublime Rules

View Source
Summary
Detects Google Cloud Storage links in inbound content where the HTML object repeats the bucket name, a hosting pattern observed in affiliate spam and account notice lures. The rule targets links whose host is storage.googleapis.com and whose path matches the form /<bucket>/<bucket>.html. It extracts the bucket/object name from the path and verifies that the path starts with '/<object>/', effectively catching URLs like /bucket/bucket.html. This pattern is commonly used by actor-controlled hosting to obfuscate or legitimize malicious content, and is surfaced via URL analysis of inbound content to flag potential spam or evasion attempts.
Categories
  • Network
  • Web
Data Sources
  • Network Traffic
Created: 2026-10-23