Possible hotlinking of brand image assets from unrecognized .shop referrer domain

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•0

This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.