ET PHISHING Paypal Phishing Landing

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET PHISHING Paypal Phishing Landing";
    flow:established,to_client;
    http.stat_code;
    content:"200";
    file.data;
    content:"|2f 67 2d 7a 31 31 38 2e 63 73 73|";
    content:"|2f 62 2d 7a 31 31 38 2e 63 73 73|"; distance:0;
    content:"|63 6c 61 73 73 3d 22 48 65 61 64 65 72 5a 31 31 38|"; distance:0;
    content:"|63 6c 61 73 73 3d 22 47 2d 46 69 65 6c 64 73 5a 31 31 38|"; distance:0; fast_pattern;
    content:"|63 6c 61 73 73 3d 22 46 69 65 6c 64 73 5a 31 31 38|"; distance:0;
    classtype:social-engineering;
    sid:2025615; rev:2;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_06_21, deployment Perimeter, confidence Medium, signature_severity Minor, tag Phishing, updated_at 2020_08_25;
)