
Summary
Detects Google Cloud Storage links in inbound content where the HTML object repeats the bucket name, a hosting pattern observed in affiliate spam and account notice lures. The rule targets links whose host is storage.googleapis.com and whose path matches the form /<bucket>/<bucket>.html. It extracts the bucket/object name from the path and verifies that the path starts with '/<object>/', effectively catching URLs like /bucket/bucket.html. This pattern is commonly used by actor-controlled hosting to obfuscate or legitimize malicious content, and is surfaced via URL analysis of inbound content to flag potential spam or evasion attempts.
Categories
- Network
- Web
Data Sources
- Network Traffic
Created: 2026-10-23