alert http $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET PHISHING NOTG Phish Landing Page 2025-02-19";
flow:established,to_client;
http.stat_code;
content:"200";
http.server;
content:"cloudflare";
http.response_body;
content:"<html>";
content:"<body>"; distance:0;
content:"<script>"; distance:0;
content:"function _0x"; distance:0;
content:"var _0x"; distance:0;
content:"loadingScreen";
content:"Hmmm|5c|x20|2e 2e|";
content:"Performing|5c|x20security|5c|x20checks|5c|x20on|5c|x20your|5c|x20browser|5c|x20for|5c|x20protection|2e|"; fast_pattern;
content:"404|5c|x20Not|5c|x20Found";
classtype:credential-theft;
sid:2060210; rev:1;
metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2025_02_19, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Phishing, tag NOTG, updated_at 2025_02_19, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;
)