Google API AddItNow Open Redirect Link Inbound

Tim Peck@timpeck

•updated Nov 11, 2025•0•25

This rule detects inbound network traffic attempting to exploit an open redirect vulnerability within the Google APIs 'AddItNow' service. Specifically, it looks for requests to 'apis.google.com/additnow/l?__lu=' which could be used to redirect users to arbitrary malicious websites.