Generic ROT13 Obfuscated URL in Parameter

Tim Peck@timpeck

•updated Jan 8, 2026•2•0•83

Detects a URL containing common redirection or proxy parameters where the value appears to be a ROT13 obfuscated URL, indicated by the presence of 'uggcf' ('https') and common ROT13'd TLDs. This is an evolution of a TTP observed in Kimsuky campaigns.