addtional support needed for shortened URL and OPEN Redirect abused

[dukebox]

There is a multiple list of shortened URL and OPEN Redirect encoded being abused by spammers. So we cannot easlily filter and block the open redirect.

CISCO ESA and CISCO ETD support many but not all of them unfortunately, forcing us to basically blocked all of them, even he legit ones.

Is there a list of upcoming support to be added?

like this shortlist from some abused we've seen on our environement

• r20.rs6.net = the BAD encoded constantcontact trackers and open redirect links...anyway to decode these? 
• *.link (app.link, page.link, sng.link etc)
• google.com/amp
• linkedin.com/slink? 

urlscan.io historical scan of phishy links abused using GOOGLE/AMP open redirect 

urlscan.io historical scan of phishy links abused using LINKEDIN open redirect 

ref : https://krebsonsecurity.com/2022/02/how-phishers-are-slinking-their-links-into-linkedin/

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trusted-domain-hidden-danger-deceptive-url-redirections-in-email-phishing-attacks/

[Ruben Cocheno]

@dukebox 

Open a new feature request with TAC