ESP Chaining Redirect Abuse (Mailchimp to ActiveCampaign)

Ethan Andrews@eandrews

•updated Jun 3, 2026•4•0•7

Detects inbound emails containing Mailchimp click-tracking links that redirect to ActiveCampaign landing pages, a known ESP chaining technique used to obscure credential harvesters. This technique is often used in phishing campaigns to bypass email security controls.