Casbaneiro Geofenced Lure Page Redirects Non-Targeted IP to Google/YouTube Root

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•2

This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.