Phishing Two-Hop Redirect via LoopedIn SaaS Open Redirect (loopedin.io)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects network activity and DNS lookups associated with the domain 'loopedin.io', which has been identified as a second-hop open-redirect service used in forged healthcare-themed phishing campaigns. The rule specifically monitors connections from common web browsers to facilitate the identification of redirected user traffic.