Two-Hop SaaS Open-Redirect via HolaBrief and LoopedIn in Email/NDR

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

This rule detects potentially malicious web traffic involving a redirect chain associated with HolaBrief and LoopedIn services, which are sometimes leveraged in phishing campaigns or credential harvesting. It identifies multi-hop redirect chains and connections to known suspicious IP addresses (217.182.211.237).