cloud1
cloud2
cloud3
cloud4
cloud5
cloud6
← Back to annotator catalog
Referrer abuse signal illustration
Annotator ref

Referrer abuse

Referrer patterns look manipulated, irrelevant, or inconsistent with normal navigation.

Attack family · Redirect abuse, traffic laundering, and origin spoofing Phase · Delivery and misdirection Risk · Medium
How It Works Recent Real Samples

What This Annotator Watches

This explanation is derived from the live annotator implementation, not hand-waved catalog copy.
Focus
  • Redirect and referrer parameter abuse
  • External referers on auth-like endpoints
  • Open-redirect and base64-wrapped redirect chains
Logic
  • The annotator looks for manipulated referrer paths and redirect-style parameters.
  • It emits multiple small findings when one request carries several redirect hints.
  • Its value is explaining why referrer analytics or auth flows look tampered with.
Attack Family
Redirect abuse, traffic laundering, and origin spoofing
Phase · Delivery and misdirection Risk · Medium
Referrer abuse tells you when an attacker is trying to fabricate navigation context, bounce through trusted surfaces, or make a malicious flow look organic.
Damage Patterns
  • Open-redirect style flows can be used for phishing, session abuse, and laundering traffic through legitimate domains.
  • Fake referrers also poison analytics and make fraud or abuse campaigns look more legitimate than they are.
Incident Lore
  • Some of the most damaging redirect issues were not memory-corruption bugs but trust bugs: users and systems followed links they believed came from a trusted path.
  • Referrer manipulation routinely appears in spam, phishing, affiliate abuse, and login-flow tampering.
How To Read It
Use this to separate natural navigation from traffic that is trying to spoof origin or bounce through your login surface.
Defender Takeaway
Use this to separate real user journeys from adversarial route-shaping. The value is in the story of misdirection.
Catalog Definition
Flags suspicious referrer behavior such as clearly fabricated referrers, referrers that do not match realistic navigation paths, or referrers used in repetitive spam-like ways. This annotator helps explain why referrer analytics may be untrustworthy and can also indicate low-effort automation or probing.

10 Most Recent Real Samples

Weekly cached from live annotated access events so the catalog stays fast.
Week
2026W15
Lookback
30 days
Total matched
817
Latest sample
Apr 05, 2026 • 20:33
Top rules
ref:external_referer_to_auth · 10
Top requester orgs
No cached organization sample yet
Severity mix
6 · 10
Method mix
GET · 9 POST · 1
POST 302 6
Apr 05, 2026 • 20:33
/admin/login/?next=/luna/q/explorer/%3Fview%3Dobservers
External referer observed on an auth-like endpoint
IP 87.71.163.156 Subnet 87.71.163.0/24 Country Israel Rule ref:external_referer_to_auth
GET 200 6
Apr 05, 2026 • 20:33
/admin/login/?next=/luna/q/explorer/%3Fview%3Dobservers
External referer observed on an auth-like endpoint
IP 87.71.163.156 Subnet 87.71.163.0/24 Country Israel Rule ref:external_referer_to_auth
GET 200 6
Apr 05, 2026 • 20:33
/admin/login/?next=/luna/q/explorer/snapshot.json%3Fview%3Dobservers%26frame%3D2026-04-05T16%253A50%253A00Z
External referer observed on an auth-like endpoint
IP 87.71.163.156 Subnet 87.71.163.0/24 Country Israel Rule ref:external_referer_to_auth
GET 200 6
Apr 05, 2026 • 20:33
/admin/login/?next=/luna/q/explorer/snapshot.json%3Fview%3Dobservers%26frame%3D2026-04-05T16%253A50%253A00Z
External referer observed on an auth-like endpoint
IP 87.71.163.156 Subnet 87.71.163.0/24 Country Israel Rule ref:external_referer_to_auth
GET 200 6
Apr 05, 2026 • 20:32
/admin/login/?next=/luna/q/explorer/snapshot.json%3Fview%3Dobservers%26frame%3D2026-04-05T16%253A50%253A00Z
External referer observed on an auth-like endpoint
IP 87.71.163.156 Subnet 87.71.163.0/24 Country Israel Rule ref:external_referer_to_auth
GET 200 6
Apr 05, 2026 • 20:32
/admin/login/?next=/luna/q/explorer/snapshot.json%3Fview%3Dobservers%26frame%3D2026-04-05T16%253A50%253A00Z
External referer observed on an auth-like endpoint
IP 87.71.163.156 Subnet 87.71.163.0/24 Country Israel Rule ref:external_referer_to_auth
GET 200 6
Apr 05, 2026 • 20:32
/admin/login/?next=/luna/q/explorer/snapshot.json%3Fview%3Dobservers%26frame%3D2026-04-05T16%253A50%253A00Z
External referer observed on an auth-like endpoint
IP 87.71.163.156 Subnet 87.71.163.0/24 Country Israel Rule ref:external_referer_to_auth
GET 200 6
Apr 05, 2026 • 20:32
/admin/login/?next=/luna/q/explorer/snapshot.json%3Fview%3Dobservers%26frame%3D2026-04-05T16%253A50%253A00Z
External referer observed on an auth-like endpoint
IP 87.71.163.156 Subnet 87.71.163.0/24 Country Israel Rule ref:external_referer_to_auth
GET 200 6
Apr 05, 2026 • 20:31
/admin/login/?next=/luna/q/explorer/snapshot.json%3Fview%3Dobservers%26frame%3D2026-04-05T16%253A50%253A00Z
External referer observed on an auth-like endpoint
IP 87.71.163.156 Subnet 87.71.163.0/24 Country Israel Rule ref:external_referer_to_auth
GET 200 6
Apr 05, 2026 • 20:31
/admin/login/?next=/luna/q/explorer/snapshot.json%3Fview%3Dobservers%26frame%3D2026-04-05T16%253A50%253A00Z
External referer observed on an auth-like endpoint
IP 87.71.163.156 Subnet 87.71.163.0/24 Country Israel Rule ref:external_referer_to_auth