alert tls $HOME_NET any -> $EXTERNAL_NET any (
msg:"ET EXPLOIT_KIT Observed ClickFix DGA Domain in TLS SNI";
flow:established,to_server;
tls.sni;
content:"booking."; nocase; startswith; fast_pattern;
content:!"booking.com"; endswith;
pcre:"/^booking\x2e(loseitems|itemsloses|lostitemshok|lostitreshok|items(ishem|idguest|guestsid)?|guest(-(stolen|idreserve|report-issue|adminportal|idreviews|checkout))?|rewies(buks|rate|gueste|command)|badrewies(bad|guest|accomader)?|rewiew(complainothergust|preferensid\d{1,6}|sgustforhouse)|partner-id\d{1,6}|part(?:ner|let|qet|det|tet|eet)-id\d{1,6}|extranet(?:update|policy|verify)|secure-partener|info-(parnter|partnet)|review(?:nowsiteadd|qhtmlisite|officialindeax|comenntsiite)?|reservation-\d{1,6}|service-faedback|internalsystemseror|unsatisfied-guest|questionable)\x2ecom$/i";
classtype:exploit-kit;
sid:2062073; rev:2;
metadata:affected_product Web_Browsers, attack_target Client_Endpoint, tls_state plaintext, created_at 2025_05_01, deployment Perimeter, malware_family ClickFix, performance_impact Low, confidence High, signature_severity Minor, tag Exploit_Kit, tag compromised_website, updated_at 2025_05_02, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise;
)