Hi Bruno, interesting question.What is your QRadar question? Of course we are able to detect something like that using rules. This would require a refset including bad urls like this one. Is that your question? Or are you referring to browser settings? Chrome and firefox handle this in different ways.Chrome default setting will offer you to visit the website which has a marketing redirect attached. URL = "BlLD.de"Firefox will not even offer the marketing page but will present google result rightaway when you include google results in your search settings. Only when you deactivate your history you will see the redirected site.